{"id":"GHSA-465w-v9q3-7j98","aliases":["RUSTSEC-2026-0338"],"status":"published","title":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","description":"When a stream is read in unordered mode (for example through `RecvStream::read(false)` in\nquinn-proto or `read_unordered` in `quinn`), quinn-proto proactively deduplicates received data\nby recording received ranges in a `RangeSet` through its `replace` method. When an incoming\nSTREAM frame carried an empty payload, the `Drop` implementation of the iterator returned by\n`replace` inserted an empty range into the set, violating the invariant that stored ranges are\nnon-empty. Subsequent frames overlapping that region then caused a panic while processing the\nstream.\n\nA remote peer can trigger this with five small STREAM frames (two of them zero-length) once the\napplication has put the stream in unordered-read mode. The default ordered read path is not\naffected.\n\nThe flaw was corrected in 0.11.18 by ignoring empty ranges in `RangeSet::replace`.\n\nThanks to Otto Hermann ([@ojhermann](https://github.com/ojhermann)) for reporting this issue.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-14T12:00:00Z","modified":"2026-10-12T18:15:01Z","fixes":[{"ecosystem":"crates.io","package":"quinn-proto","fixed_in":["0.11.18"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"quinn-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0"},{"fixed":"0.11.18"}]}]}],"references":[{"url":"https://crates.io/crates/quinn-proto","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0338.html","tags":["advisory"]},{"url":"https://github.com/quinn-rs/quinn/pull/2868","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0338","title":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","description":"When a stream is read in unordered mode (for example through `RecvStream::read(false)` in\nquinn-proto or `read_unordered` in `quinn`), quinn-proto proactively deduplicates received data\nby recording received ranges in a `RangeSet` through its `replace` method. When an incoming\nSTREAM frame carried an empty payload, the `Drop` implementation of the iterator returned by\n`replace` inserted an empty range into the set, violating the invariant that stored ranges are\nnon-empty. Subsequent frames overlapping that region then caused a panic while processing the\nstream.\n\nA remote peer can trigger this with five small STREAM frames (two of them zero-length) once the\napplication has put the stream in unordered-read mode. The default ordered read path is not\naffected.\n\nThe flaw was corrected in 0.11.18 by ignoring empty ranges in `RangeSet::replace`.\n\nThanks to Otto Hermann ([@ojhermann](https://github.com/ojhermann)) for reporting this issue.","status":"published","published":"2026-09-14T12:00:00Z","modified":"2026-10-12T18:15:01.969514645Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}