Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-31812: Quinn Denial of Service via Bad QUIC Parameters
CVE-2026-31812 · published 7 months ago
Summary
A bug in Quinn's QUIC protocol handling can cause Quinn to crash if it receives invalid QUIC parameters. This issue can be triggered by a malicious or misconfigured QUIC peer. To protect your system, update Quinn to the latest version, which includes a fix for this issue.
What to do
- Update djc quinn-proto to version 0.11.14.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | rust-quinn | All versions |
| Debian:12 | debian | rust-quinn | All versions |
| Debian:13 | debian | rust-quinn | All versions |
| crates.io | djc | quinn-proto |
>= 0.5.0, < 0.11.14 Fix: upgrade to 0.11.14
|
| Debian:12 | debian | rust-quinn-proto | All versions |
| Debian:13 | debian | rust-quinn-proto | All versions |
| Debian:14 | debian | rust-quinn-proto | All versions |
| – | quinn-rs | quinn | < 0.11.14 |
| rust | djc | quinn-proto |
< 0.11.14 Fix: upgrade to 0.11.14
|
| Ubuntu:24.04:LTS | canonical | rust-quinn-proto | All versions |
Original advisory text
Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31812... Vendor Advisory
- https://github.com/quinn-rs/quinn/pull/2559
- https://github.com/advisories/GHSA-6xvm-j4wr-6v98
- https://github.com/quinn-rs/quinn Product
- https://crates.io/crates/quinn-proto Product
- https://rustsec.org/advisories/RUSTSEC-2026-0037.html Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:13545 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19712 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:22862 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-31812 Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31812.json URL
- https://access.redhat.com/errata/RHSA-2026:5459 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-31812 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-31812 Third Party Advisory
- https://github.com/quinn-rs/quinn/pull/2558 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-31812 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-31812 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2446330 Third Party Advisory
- https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-248Uncaught Exception
Timeline
Published10 Mar 2026
Updated3 Nov 2026
First seen10 Mar 2026
Sources
DEBIAN-CVE-2026-31812 · OSV
CVE-2026-31812 · NVD
GHSA-6xvm-j4wr-6v98 · GHSA
RUSTSEC-2026-0037 · OSV
CVE-2026-31812 · OSV
CVE-2026-31812 · MITRE
UBUNTU-CVE-2026-31812 · OSV
Track software like this
Free during beta