{"id":"RUSTSEC-2026-0343","revision":"02effbfd067648d8bba0cc51e52a8d4e","records":[{"revision":"02effbfd067648d8bba0cc51e52a8d4e","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0343","aliases":["GHSA-ppcp-v39w-8jq2"],"title":"Outgoing datagram buffer accounting can panic the sender in quinn-proto","description":"The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an\nevicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called\nwith `drop = true` (as `Connection::send_datagram` in the `quinn` crate does) while the buffer was\nfull. Under sustained eviction the counter drifts below its true value: debug builds panic with an\ninteger underflow, while release builds wrap the counter, drain the whole queue, and then panic on\na desynchronization check in a later `send` call. In `quinn`, this panic occurs while the\nconnection lock is held, poisoning it and causing a double panic (and thus an abort) when the\nconnection is dropped.\n\nThis can be triggered without a malicious peer, by an application that sends a burst of datagrams\nand then idles. It can also be triggered by a peer that keeps the connection alive with PING frames\nwhile withholding acknowledgements, so that the sender's congestion window stays closed and the\noutgoing queue never drains. Applications that use `send_datagram_wait` are not affected.\n\nOnly 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.\n\nThanks to [@alexpyattaev](https://github.com/alexpyattaev) for reporting and\n[@vcarus](https://github.com/vcarus) for fixing this issue.","state":0,"publishedAt":"2026-09-14T12:00:00+00:00","modifiedAt":"2026-10-12T18:15:01.9617458+00:00","affected":[{"ecosystem":"crates.io","name":"quinn-proto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.11.17"},{"kind":"fixed","version":"0.11.18"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/quinn-proto","https://rustsec.org/advisories/RUSTSEC-2026-0343.html","https://github.com/quinn-rs/quinn/pull/2806"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0343","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0343","identifiers":["RUSTSEC-2026-0343","GHSA-ppcp-v39w-8jq2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}