AIKIDO-2026-862145
quinn-proto is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
quinn-protoTL;DR
quinn-proto charges each queued QUIC DATAGRAM frame against the configured datagram_receive_buffer_size limit using the frame payload length. A frame with a zero-length payload is charged nothing, so the eviction loop never runs and the frame is appended to a queue that has no other bound. A connected peer can send a continuous stream of empty DATAGRAM frames to force unbounded heap growth and exhaust memory on the receiver. The fix accounts for a fixed per-frame overhead so empty datagrams count against the buffer limit and the queue stays bounded.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
quinn-proto is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 0.11.16.
How to fix this
Upgrade the quinn-proto library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant