RUSTSEC-2026-0338 Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
Remote attackers can crash applications using quinn-proto by sending zero-length STREAM frames during unordered reads, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0338?
RUSTSEC-2026-0338 is a denial of service vulnerability in quinn-proto, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When a stream is read in unordered mode (for example through RecvStream::read(false) in
quinn-proto or read_unordered in quinn), quinn-proto proactively deduplicates received data
by recording received ranges in a RangeSet through its replace method. When an incoming
STREAM frame carried an empty payload, the Drop implementation of the iterator returned by
replace inserted an empty range into the set, violating the invariant that stored ranges are
non-empty. Subsequent frames overlapping that region then caused a panic while processing the
stream.
A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected.
The flaw was corrected in 0.11.18 by ignoring empty ranges in RangeSet::replace.
Thanks to Otto Hermann (@ojhermann) for reporting this issue.
Which versions are affected by RUSTSEC-2026-0338?
1 open source package ship an affected version, including quinn-proto.
| Package | Affected | Fixed in |
|---|---|---|
quinn-proto crates.io | From 0.7.0 | 0.11.18 |
How do I fix RUSTSEC-2026-0338?
Upgrade quinn-proto to 0.11.18 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is RUSTSEC-2026-0338 being exploited?
There is no known exploitation of RUSTSEC-2026-0338 in the wild and no public exploit code.
Sources
Also known as GHSA-465w-v9q3-7j98.