CVE-2026-25800 quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly
Remote attackers can cause memory exhaustion in applications using the quinn-proto library by sending fragmented QUIC stream data with gaps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25800?
CVE-2026-25800 is a high-severity denial of service vulnerability in quinn-rs quinn, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.
Weakness: CWE-770
Which versions are affected by CVE-2026-25800?
4 open source packages ship an affected version, including quinn-proto.
| Package | Affected | Fixed in |
|---|---|---|
quinn-proto crates.io | From 0.0.0-0 | 0.11.15 |
quinn-proto crates.io | From 0.1.0 | 0.11.15 |
quinn-proto crates.io | From 0.1.0 | 0.11.15 |
quinn-proto crates.io | From 0.11.15 | 0.11.17 |
Linux distribution packages (3)
openai-codex openSUSE:Leap 16.0 | All versions | 0.154.0-bp160.1.1 |
openai-codex openSUSE:Tumbleweed | All versions | 0.152.0-1.1 |
python-uv openSUSE:Tumbleweed | All versions | 0.12.7-1.1 |
How do I fix CVE-2026-25800?
Upgrade quinn-proto to a fixed version for your release line: 0.11.15 or 0.11.17.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-25800 being exploited?
There is no known exploitation of CVE-2026-25800 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-25800, GHSA-4w2j-m93h-cj5j, GHSA-qfwj-vfxf-92j2, MINI-4jv8-9w8q-jqqc, MINI-4xpc-vv54-h77c, MINI-7534-x6x6-w9v6 and 14 more.