Quinn proto: Long Retry token can panic or exhaust memory in a QUIC client
Affects quinn-protoSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.11.19
Data as of 13 Nov 2026, 13:17 UTC
What to do
Upgrade quinn-proto to 0.11.19.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioquinn-protopkg:cargo/quinn-protoOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade quinn-proto to version 0.11.19 or later, which includes a fix that closes connections with PROTOCOL_VIOLATION when Initial tokens are too large. This prevents the memory exhaustion and panic conditions. No other mitigations are indicated.
Description
A vulnerability in quinn-proto allows a client to retain an excessively long Retry token from a Retry packet without length limits, causing memory exhaustion or panic in the QUIC client. This occurs because the token is included in every Initial packet header, leading to an invalid packet size calculation. The issue affects all quinn-proto clients making outgoing connections. The flaw is fixed in version 0.11.19 by closing connections with PROTOCOL_VIOLATION when tokens leave insufficient room for frames.
References
- crates.io/crates/quinn-proto (opens in a new tab)
- rustsec.org/advisories/RUSTSEC-2026-0524.html (opens in a new tab)
- github.com/quinn-rs/quinn/commit/3bba467893ceff64d6cda0b3a2c51a1429e10372 (opens in a new tab)
- github.com/quinn-rs/quinn/commit/d45b5136ed1d5b2b04ff6456443c0662acf1d0d3 (opens in a new tab)
- github.com/quinn-rs/quinn/commit/74c33ff75281d7751488e410e21e4f030782b655 (opens in a new tab)
- github.com/quinn-rs/quinn/commit/a6e78d1c8bf28630f1e92fbcc38f60e0a134b01a (opens in a new tab)