AIKIDO-2026-560280
quinn-proto is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
quinn-protoTL;DR
quinn-proto's AckFrequencyState::candidate_max_ack_delay computes an ACK delay window by clamping a value between a peer supplied minimum and a maximum computed from the connection's RTT. When a peer advertises a min_ack_delay transport parameter higher than the computed maximum, the clamp's lower bound exceeds its upper bound and the call panics. The fix bounds the computed maximum so it can no longer fall below the peer supplied minimum.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable ACK_FREQUENCY transmission through TransportConfig::ack_frequency_config.
Background info
quinn-proto is vulnerable to Denial of Service (DoS) in versions 0.11.0 - 0.11.17.
How to fix this
Upgrade the quinn-proto library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.