CVE-2026-25800

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25800
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25800.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25800
Aliases
Downstream
Published
2026-07-23T19:09:19.159Z
Modified
2026-07-25T04:14:41.794970Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly
Details

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25800.json"
}
References

Affected packages

Git / github.com/quinn-rs/quinn

Affected ranges

Type
GIT
Repo
https://github.com/quinn-rs/quinn
Events
Introduced
487c38953651a2889137f6d795cb28b8547f425c
Fixed
a7499b8439e393a6299330111d9c8564cd96c464
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.11.15"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.2.0
0.3.0
0.4.0
0.5.0
0.6.0
0.6.1
0.7.0
0.8.0
0.9.0
0.9.1
0.9.2
0.9.3
quinn-0.*
quinn-0.11.2
quinn-0.11.3
quinn-0.11.4
quinn-0.11.5
quinn-0.11.6
quinn-0.11.7
quinn-0.11.8
quinn-0.11.9
quinn-proto-0.*
quinn-proto-0.11.10
quinn-proto-0.11.11
quinn-proto-0.11.12
quinn-proto-0.11.13
quinn-proto-0.11.14
quinn-proto-0.11.3
quinn-proto-0.11.4
quinn-proto-0.11.5
quinn-proto-0.11.6
quinn-proto-0.11.7
quinn-proto-0.11.8
quinn-proto-0.11.9
quinn-udp-0.*
quinn-udp-0.5.10
quinn-udp-0.5.11
quinn-udp-0.5.12
quinn-udp-0.5.13
quinn-udp-0.5.14
quinn-udp-0.5.2
quinn-udp-0.5.3
quinn-udp-0.5.4
quinn-udp-0.5.5
quinn-udp-0.5.6
quinn-udp-0.5.7
quinn-udp-0.5.8
quinn-udp-0.5.9
udp-0.*
udp-0.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25800.json"