CVE-2026-31812 Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

What is CVE-2026-31812?

CVE-2026-31812 is a high-severity denial of service vulnerability in quinn-rs quinn, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.

Weakness: CWE-248

Which versions are affected by CVE-2026-31812?

3 open source packages ship an affected version, including quinn-proto.

How do I fix CVE-2026-31812?

Upgrade quinn-proto to 0.11.14 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-31812 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31812 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-31812, GHSA-6xvm-j4wr-6v98, MINI-7738-rch2-rpvr, MINI-pxcx-gx6w-vfrx, MINI-q752-vwgg-fh85, RUSTSEC-2026-0037 and 10 more.