AIKIDO-2026-978085

TL;DR

quinn-proto reassembles out-of-order STREAM data in a buffer guarded by a chunk cap that is enforced during defragmentation. The defragmentation check only runs when allocation exceeds a dynamic threshold, so a peer that keeps the overhead below that threshold avoids defragmentation and bypasses the chunk limit entirely. A remote, unauthenticated peer can send many small gapped stream fragments to pin more receiver memory than the accounted stream data, leading to memory exhaustion. The fix tightens the reassembly accounting so the guard cannot be bypassed by low overhead fragments.