RUSTSEC-2026-0037

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0037

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0037.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0037

Aliases

Published

2026-03-09T12:00:00Z

Modified

2026-03-14T07:30:14.675976Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Denial of service in Quinn endpoints

Details

Receiving QUIC transport parameters containing invalid values could lead to a panic.

Unfortunately the maintainers did not properly assess usage of unwrap() calls in the transport parameters parsing code, and we did not have sufficient fuzzing coverage to find this issue. We have since added a fuzzing target to cover this code path.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / quinn-proto

Package

Name: quinn-proto; View open source insights on deps.dev
Purl: pkg:cargo/quinn-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.5.0

Fixed

0.11.14

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "os": [],
        "functions": []
    }
}

Database specific

informational

null