RUSTSEC-2026-0340 Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
A remote attacker can cause a denial of service by sending crafted transport parameters to a quinn-proto server with ACK frequency enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0340?
RUSTSEC-2026-0340 is a denial of service vulnerability in quinn-proto, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When sending ACK_FREQUENCY frames is enabled through
TransportConfig::ack_frequency_config(Some(..)), the peer's transport parameters could cause
AckFrequencyState::candidate_max_ack_delay to call Duration::clamp with a minimum greater
than its maximum, which panics.
For example, a peer advertising a min_ack_delay of 100,000 microseconds and a max_ack_delay
of 100 milliseconds passes transport parameter validation. At a 5 ms RTT, the lower bound of the
clamp becomes 100 ms while the upper bound is 25 ms, violating the precondition of clamp and
panicking while driving the connection. Both automatically derived and explicitly configured
maximum ACK delays use this calculation.
Sending ACK_FREQUENCY frames is disabled by default, so only endpoints that opt in are affected.
The flaw was corrected in 0.11.18 by computing the delay with explicit minimum and maximum bounds
instead of clamp.
Thanks to @zerox80 for reporting this issue.
Which versions are affected by RUSTSEC-2026-0340?
1 open source package ship an affected version, including quinn-proto.
| Package | Affected | Fixed in |
|---|---|---|
quinn-proto crates.io | From 0.11.0 | 0.11.18 |
How do I fix RUSTSEC-2026-0340?
Upgrade quinn-proto to 0.11.18 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is RUSTSEC-2026-0340 being exploited?
There is no known exploitation of RUSTSEC-2026-0340 in the wild and no public exploit code.
Sources
Also known as GHSA-3g6h-r5qx-f6hq.