Unbounded growth of pending connection ID retirements in quinn-proto

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

When processing a NEW_CONNECTION_ID frame, quinn-proto queues a RETIRE_CONNECTION_ID frame for each connection ID that the peer asked it to retire. The normal path bounds this queue and closes the connection with a CONNECTION_ID_LIMIT_ERROR if the bound would be exceeded. However, the path handling a connection ID that had already been retired pushed onto the queue without applying the limit and without deduplicating. A peer that has completed the handshake can first send a NEW_CONNECTION_ID frame with a large `retire_prior_to` value to advance the receiver's connection ID window, and then repeatedly send NEW_CONNECTION_ID frames with sequence numbers below that window. Each such frame adds another entry to the queue. The queue is only drained by sending RETIRE_CONNECTION_ID frames, which are subject to congestion control, so a peer that withholds acknowledgements can stall the drain while continuing to flood, growing the victim's memory use without bound. The flaw was corrected in 0.11.17 by applying the same limit on the already-retired path. Thanks to [@scadastrangelove](https://github.com/scadastrangelove) for reporting this issue.

Source published

17 Aug 2026 12:00:00 UTC

Source modified

12 Oct 2026 18:15:01 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.