Denial of Service Vulnerability in Quinn by Rust
CVE-2026-31812

8.7HIGH

Key Information:

Vendor

Quinn-rs

Status
Quinn
Vendor
CVE Published:
10 March 2026

What is CVE-2026-31812?

A vulnerability in Quinn, a Rust implementation of the IETF QUIC transport protocol, allows remote, unauthenticated attackers to trigger a denial of service. By sending a specifically crafted QUIC Initial packet with malformed QUIC transport parameters to vulnerable versions, attackers can exploit a flaw in the parsing logic. This results in a panic condition due to improperly handled varints, reachable through a single packet over the network, without requiring prior trust or authentication. The issue is resolved in version 0.11.14.

Affected Version(s)

quinn < 0.11.14

References

https://github.com/quinn-rs/quinn/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.