Log in Start free

Vulnerability · Published Jul 23, 2026 · Assigned by GitHub_M

CVE-2026-25800quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly

High 7.5

In plain English

A high-severity resource allocation without limits in quinn from quinn-rs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-quinn-protono fix listedDEBIAN-CVE-2026-25800
Debian:13rust-quinn-protono fix listedDEBIAN-CVE-2026-25800
Debian:14rust-quinn-proto0.11.16-1DEBIAN-CVE-2026-25800
Ubuntu:24.04:LTSrust-quinn-protono fix listedUBUNTU-CVE-2026-25800
Ubuntu:26.04:LTSrust-quinn-protono fix listedUBUNTU-CVE-2026-25800
Ubuntu:26.10rust-quinn-protono fix listedUBUNTU-CVE-2026-25800

Affected products (as reported)

VendorProductVersions
quinn-rs quinn >= 0.1.0, < 0.11.15

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References