RUSTSEC-2026-0343: quinn-proto Crates.Io

Vulnerability summary

RUSTSEC-2026-0343 is a high (CVSS 7.5) vulnerability in quinn-proto Crates.Io.

Timeline

1. 14-09-2026
   PublishedVulnerability first disclosed.
2. 12-10-2026
   Last modifiedVulnerability information updated.

Description

Outgoing datagram buffer accounting can panic the sender in quinn-proto The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an evicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called with `drop = true` (as `Connection::send_datagram` in the `quinn` crate does) while the buffer was full. Under sustained eviction the counter drifts below its true value: debug builds panic with an integer underflow, while release builds wrap the counter, drain the whole queue, and then panic on a desynchronization check in a later `send` call. In `quinn`, this panic occurs while the connection lock is held, poisoning it and causing a double panic (and thus an abort) when the connection is dropped. This can be triggered without a malicious peer, by an application that sends a burst of datagrams and then idles. It can also be triggered by a peer that keeps the connection alive with PING frames while withholding acknowledgements, so that the sender's congestion window stays closed and the outgoing queue never drains. Applications that use `send_datagram_wait` are not affected. Only 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction. Thanks to [@alexpyattaev](https://github.com/alexpyattaev) for reporting and [@vcarus](https://github.com/vcarus) for fixing this issue.

No weakness data has been published for this record.