8.7

CVE-2026-31812: quinn-rs quinn Uncaught Exception

CVSS: 8.7v4.0HighDeferred
AliasesSUSE-RU-2026:1001-1SUSE-SU-2026:1337-1SUSE-SU-2026:1415-1
Published 10-03-2026Last modified 25-08-2026
Open JSON

Vulnerability summary

CVE-2026-31812 is a high (CVSS 8.7) Uncaught Exception vulnerability in quinn-rs quinn. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.7% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.92%
0%100%
Low · +0.42 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
SUSE-SU-2026:22005-1CGA-CQ2M-2GHH-C6HG

Timeline

  1. 10-03-2026
    PublishedVulnerability first disclosed.
  2. 25-08-2026
    Last modifiedVulnerability information updated.

Description

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.

CVSS metrics

10 scores · 7 sources · 2 versions

EPSS trend

Probability

0.92%

Chance of exploitation in the next 30 days

Percentile

60%

Versus all other CVEs

30-day change

+0.42 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.92%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard30 products
  • apollo-router-2< 2.16.0-r1
  • asciinema< 3.2.0-r1
  • berg< 0.5.5-r2
  • cargo-audit< 0.22.1-r3
  • fnm< 1.39.0-r1
Suse24 products
  • rust1.92&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7< 1.92.0-150300.7.6.1
  • rust1.93&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7< 1.93.0-150300.7.6.1
  • rust1.94&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.94.0-150300.7.6.1
  • rust1.94&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.94.0-150300.7.6.1
  • rust1.94&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 1.94.0-150300.7.6.1
Wolfi23 products
  • berg< 0.5.5-r2
  • cargo-audit< 0.22.1-r3
  • lychee< 0.23.0-r2
  • nushell< 0.111.0-r4
  • nushell-plugins< 0.111.0-r4
Opensuse9 products
  • python-uv&distro=openSUSE Tumbleweed< 0.10.11-1.1
  • rust1.92&distro=openSUSE Leap 15.6< 1.92.0-150300.7.6.1
  • rust1.92&distro=openSUSE Tumbleweed< 1.92.0-2.1
  • rust1.93&distro=openSUSE Leap 15.6< 1.93.0-150300.7.6.1
  • rust1.93&distro=openSUSE Tumbleweed< 1.93.0-3.1
Crates.Io1 product
  • quinn-proto< 0.11.14 | ≥ 0.5.0, < 0.11.14
Debian1 product
  • rust-quinn-protoAll versions (No fix recorded) | < 0.11.14-1
Quinn-rs1 product
Ubuntu1 product
  • rust-quinn-protoAll versions (No fix recorded)

8 vendors · 90 products

References

25 links
Show all 25 references