Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Versions before 0.11.14 contain a vulnerability where the parsing logic for QUIC transport parameters uses unwrap() on varints controlled by an attacker. If a truncated varint encoding is received in a QUIC Initial packet, this triggers an Err(UnexpectedEnd) error and causes the application to panic, resulting in a denial of service. This attack can be performed remotely without authentication by sending a single crafted packet. The vulnerability is addressed in quinn version 0.11.14.

A remote, unauthenticated attacker can cause a denial of service in applications using vulnerable versions of quinn by sending a single malformed QUIC Initial packet. This leads to a panic in the parsing logic and crashes the application, potentially disrupting service availability. There is no indication of code execution or data disclosure. The CVSS 4.0 score is 8.7 (high severity), reflecting the ease of exploitation and impact on availability.

Upgrade quinn to version 0.11.14 or later, where this vulnerability is fixed. The vendor advisory confirms that the issue is resolved in 0.11.14. No other mitigations are specified or required. Patch status is confirmed by the vendor advisory.