CVE-2023-42805 quinn-proto Denial of Service vulnerability

High 7.5 Published 21 Sep 2023 Updated 24 Sep 2024

Attackers can cause a denial of service by sending unknown QUIC frames, crashing the application using the quinn-proto library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-42805?

CVE-2023-42805 is a high-severity denial of service vulnerability in quinn-rs quinn, published on 21 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

Weakness: CWE-20

Which versions are affected by CVE-2023-42805?

3 open source packages ship an affected version, including quinn-proto. It affects 1 product.

Package	Affected	Fixed in
`quinn-proto` crates.io	All versions	`0.9.5`
`quinn-proto` crates.io	All versions	`0.9.5`
`quinn-proto` crates.io	From `0.0.0-0`	`0.9.5, 0.10.5`

Products include Quinn Project Quinn.

How do I fix CVE-2023-42805?

Upgrade quinn-proto to a fixed version for your release line: 0.9.5 or 0.10.5.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-42805 being exploited?

There is no known exploitation of CVE-2023-42805 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2023-42805, GHSA-q8wc-j5m9-27w3, RUSTSEC-2023-0063, UBUNTU-CVE-2023-42805.