From 76d397ed25eb39b9d63e8e89f6b4d8858547bffb Mon Sep 17 00:00:00 2001 From: Dirkjan Ochtman Date: Mon, 22 Jun 2026 11:54:21 +0200 Subject: [PATCH] quinn-proto: remote memory exhaustion --- crates/quinn-proto/RUSTSEC-0000-0000.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 crates/quinn-proto/RUSTSEC-0000-0000.md diff --git a/crates/quinn-proto/RUSTSEC-0000-0000.md b/crates/quinn-proto/RUSTSEC-0000-0000.md new file mode 100644 index 00000000..3f770320 --- /dev/null +++ b/crates/quinn-proto/RUSTSEC-0000-0000.md @@ -0,0 +1,23 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "quinn-proto" +date = "2026-06-22" +url = "https://github.com/quinn-rs/quinn/pull/2694" +categories = ["denial-of-service"] +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" +keywords = ["oom"] +aliases = ["GHSA-4w2j-m93h-cj5j"] + +[versions] +patched = [">= 0.11.15"] +``` + +# Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly + +The `Assembler` component that assembles unordered stream fragments into consecutive chunks of the +stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in +order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments +while leaving out early parts of the stream, and in particular, fragments with many gaps (because +these cannot be defragmented). In such a scenario, the receiving connection suffers from high +buffer overhead, enabling memory exhaustion.