RUSTSEC-2026-0338: quinn-proto Crates.Io

CVSS: UnknownPublished
AliasesGHSA-465w-v9q3-7j98
Published 14-09-2026Last modified 12-10-2026
Open JSON

Vulnerability summary

RUSTSEC-2026-0338 is a vulnerability in quinn-proto Crates.Io with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 14-09-2026
    PublishedVulnerability first disclosed.
  2. 12-10-2026
    Last modifiedVulnerability information updated.

Description

Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads When a stream is read in unordered mode (for example through `RecvStream::read(false)` in quinn-proto or `read_unordered` in `quinn`), quinn-proto proactively deduplicates received data by recording received ranges in a `RangeSet` through its `replace` method. When an incoming STREAM frame carried an empty payload, the `Drop` implementation of the iterator returned by `replace` inserted an empty range into the set, violating the invariant that stored ranges are non-empty. Subsequent frames overlapping that region then caused a panic while processing the stream. A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected. The flaw was corrected in 0.11.18 by ignoring empty ranges in `RangeSet::replace`. Thanks to Otto Hermann ([@ojhermann](https://github.com/ojhermann)) for reporting this issue.

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Crates.Io1 product
  • quinn-proto≥ 0.7.0, < 0.11.18

1 vendor · 1 product

References

3 links