RUSTSEC-2026-0338

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0338

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0338.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0338

Aliases

GHSA-465w-v9q3-7j98

Published

2026-09-14T12:00:00Z

Modified

2026-10-12T18:15:01Z

Summary

Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads

Details

When a stream is read in unordered mode (for example through RecvStream::read(false) in quinn-proto or read_unordered in quinn), quinn-proto proactively deduplicates received data by recording received ranges in a RangeSet through its replace method. When an incoming STREAM frame carried an empty payload, the Drop implementation of the iterator returned by replace inserted an empty range into the set, violating the invariant that stored ranges are non-empty. Subsequent frames overlapping that region then caused a panic while processing the stream.

A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected.

The flaw was corrected in 0.11.18 by ignoring empty ranges in RangeSet::replace.

Thanks to Otto Hermann (@ojhermann) for reporting this issue.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / quinn-proto

Package

Name: quinn-proto; View open source insights on deps.dev
Purl: pkg:cargo/quinn-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.7.0

Fixed

0.11.18

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}