CVE-2026-31812highCWE-248

CVE-2026-31812: falha de alta gravidade em quinn-rs quinn

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar quinn+ Monitorar quinn-proto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.6%
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
quinn-rs · quinn
CVEs relacionadas — quinn-rs quinn

No mesmo produto, das mais perigosas para as menos.

CVE-2023-42805HIGHquinn-proto Denial of Service vulnerabilityEPSS 0.9%CVE-2026-25800HIGHquinn-proto has remote memory exhaustion from unbounded out-of-order stream reassemblyEPSS 0.8%CVE-2024-45311HIGHDenial of service in quinn-proto when using `Endpoint::retry()`EPSS 0.6%