Outgoing datagram buffer accounting can panic the sender in quinn-proto

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an evicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called with `drop = true` (as `Connection::send_datagram` in the `quinn` crate does) while the buffer was full. Under sustained eviction the counter drifts below its true value: debug builds panic with an integer underflow, while release builds wrap the counter, drain the whole queue, and then panic on a desynchronization check in a later `send` call. In `quinn`, this panic occurs while the connection lock is held, poisoning it and causing a double panic (and thus an abort) when the connection is dropped. This can be triggered without a malicious peer, by an application that sends a burst of datagrams and then idles. It can also be triggered by a peer that keeps the connection alive with PING frames while withholding acknowledgements, so that the sender's congestion window stays closed and the outgoing queue never drains. Applications that use `send_datagram_wait` are not affected. Only 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction. Thanks to [@alexpyattaev](https://github.com/alexpyattaev) for reporting and [@vcarus](https://github.com/vcarus) for fixing this issue.

Source published

14 Sep 2026 12:00:00 UTC

Source modified

12 Oct 2026 18:15:01 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H