{"answers":{"affected":"1 open source package ship an affected version, including quinn-proto.","exploited":"There is no known exploitation of RUSTSEC-2026-0343 in the wild and no public exploit code.","fix":"Upgrade quinn-proto to 0.11.18 or later.","what":"RUSTSEC-2026-0343 is a vulnerability in quinn-proto, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0343 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0343 is a vulnerability in quinn-proto, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of RUSTSEC-2026-0343 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- quinn-proto (crates.io): affected from 0.11.17; fixed in 0.11.18\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0343/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0343/index.md)","id":"RUSTSEC-2026-0343","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0343/index.md","name":"RUSTSEC-2026-0343","record":{"aliases":["GHSA-ppcp-v39w-8jq2"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"QUIC protocol library","requires_auth":"none","summary":"A double subtraction bug in quinn-proto causes integer underflow and panics, leading to denial of service when sending datagrams.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an\nevicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called\nwith `drop = true` (as `Connection::send_datagram` in the `quinn` crate does) while the buffer was\nfull. Under sustained eviction the counter drifts below its true value: debug builds panic with an\ninteger underflow, while release builds wrap the counter, drain the whole queue, and then panic on\na desynchronization check in a later `send` call. In `quinn`, this panic occurs while the\nconnection lock is held, poisoning it and causing a double panic (and thus an abort) when the\nconnection is dropped.\n\nThis can be triggered without a malicious peer, by an application that sends a burst of datagrams\nand then idles. It can also be triggered by a peer that keeps the connection alive with PING frames\nwhile withholding acknowledgements, so that the sender's congestion window stays closed and the\noutgoing queue never drains. Applications that use `send_datagram_wait` are not affected.\n\nOnly 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.\n\nThanks to [@alexpyattaev](https://github.com/alexpyattaev) for reporting and\n[@vcarus](https://github.com/vcarus) for fixing this issue.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Outgoing datagram buffer accounting can panic the sender in quinn-proto","id":"RUSTSEC-2026-0343","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.11.18"],"introduced":["0.11.17"],"last_affected":[],"package":"quinn-proto","purl":"pkg:cargo/quinn-proto","source":"RUSTSEC-2026-0343"}],"products":null,"published":"2026-09-14","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A double subtraction bug in quinn-proto causes integer underflow and panics, leading to denial of service when sending datagrams.","url":"https://insights.sbomify.com/RUSTSEC-2026-0343/"}