{"id":"GHSA-ppcp-v39w-8jq2","aliases":["RUSTSEC-2026-0343"],"status":"published","title":"Outgoing datagram buffer accounting can panic the sender in quinn-proto","description":"The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an\nevicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called\nwith `drop = true` (as `Connection::send_datagram` in the `quinn` crate does) while the buffer was\nfull. Under sustained eviction the counter drifts below its true value: debug builds panic with an\ninteger underflow, while release builds wrap the counter, drain the whole queue, and then panic on\na desynchronization check in a later `send` call. In `quinn`, this panic occurs while the\nconnection lock is held, poisoning it and causing a double panic (and thus an abort) when the\nconnection is dropped.\n\nThis can be triggered without a malicious peer, by an application that sends a burst of datagrams\nand then idles. It can also be triggered by a peer that keeps the connection alive with PING frames\nwhile withholding acknowledgements, so that the sender's congestion window stays closed and the\noutgoing queue never drains. Applications that use `send_datagram_wait` are not affected.\n\nOnly 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.\n\nThanks to [@alexpyattaev](https://github.com/alexpyattaev) for reporting and\n[@vcarus](https://github.com/vcarus) for fixing this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-14T12:00:00Z","modified":"2026-10-12T18:15:01Z","fixes":[{"ecosystem":"crates.io","package":"quinn-proto","fixed_in":["0.11.18"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"quinn-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.17"},{"fixed":"0.11.18"}]}]}],"references":[{"url":"https://crates.io/crates/quinn-proto","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0343.html","tags":["advisory"]},{"url":"https://github.com/quinn-rs/quinn/pull/2806","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0343","title":"Outgoing datagram buffer accounting can panic the sender in quinn-proto","description":"The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an\nevicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called\nwith `drop = true` (as `Connection::send_datagram` in the `quinn` crate does) while the buffer was\nfull. Under sustained eviction the counter drifts below its true value: debug builds panic with an\ninteger underflow, while release builds wrap the counter, drain the whole queue, and then panic on\na desynchronization check in a later `send` call. In `quinn`, this panic occurs while the\nconnection lock is held, poisoning it and causing a double panic (and thus an abort) when the\nconnection is dropped.\n\nThis can be triggered without a malicious peer, by an application that sends a burst of datagrams\nand then idles. It can also be triggered by a peer that keeps the connection alive with PING frames\nwhile withholding acknowledgements, so that the sender's congestion window stays closed and the\noutgoing queue never drains. Applications that use `send_datagram_wait` are not affected.\n\nOnly 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.\n\nThanks to [@alexpyattaev](https://github.com/alexpyattaev) for reporting and\n[@vcarus](https://github.com/vcarus) for fixing this issue.","status":"published","published":"2026-09-14T12:00:00Z","modified":"2026-10-12T18:15:01.96174582Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}