CVE-2026-25800 Details
Description
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.
A remote memory exhaustion vulnerability has been identified in the Quinn library, specifically in versions 0.1.0 prior to 0.11.15. The issue arises in the 'Assembler' component, which is responsible for reassembling unordered stream fragments into a continuous stream. This component creates overhead for non-contiguous fragments, particularly affecting readers that process 'RecvStream' data in order. The vulnerability is exacerbated when peers send fragments that omit earlier parts of the stream, especially those with multiple gaps, as these cannot be defragmented. Consequently, the receiving connection experiences significant buffer overhead, leading to memory exhaustion.
Users can upgrade to Quinn version 0.11.15 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/quinn-rs/quinn/pull/2694 | [email protected] | Source CodeVendor |
| https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j | [email protected] | AdvisoryVendor |
| https://rustsec.org/advisories/RUSTSEC-2026-0185.html | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| quinn-rs Quinn | >= 0.1.0, < 0.11.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | New CVE Received | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |