Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

When a stream is read in unordered mode (for example through `RecvStream::read(false)` in quinn-proto or `read_unordered` in `quinn`), quinn-proto proactively deduplicates received data by recording received ranges in a `RangeSet` through its `replace` method. When an incoming STREAM frame carried an empty payload, the `Drop` implementation of the iterator returned by `replace` inserted an empty range into the set, violating the invariant that stored ranges are non-empty. Subsequent frames overlapping that region then caused a panic while processing the stream. A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected. The flaw was corrected in 0.11.18 by ignoring empty ranges in `RangeSet::replace`. Thanks to Otto Hermann ([@ojhermann](https://github.com/ojhermann)) for reporting this issue.

Source published

14 Sep 2026 12:00:00 UTC

Source modified

12 Oct 2026 18:15:01 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.