Quinn proto: MAX_STREAM_DATA frame can open streams beyond the stream limit
Affects quinn-protoSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.11.19
Data as of 13 Nov 2026, 13:17 UTC
What to do
Upgrade quinn-proto to 0.11.19.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioquinn-protopkg:cargo/quinn-protoOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to quinn-proto version 0.11.19 or later, where the vulnerability is fixed by proper validation of stream IDs and defensive checks on stream opening. No other mitigation is required as the fix addresses the root cause.
Description
A vulnerability in quinn-proto versions 0.11.0 through 0.11.18 allows a peer to open an excessive number of bidirectional streams by sending a MAX_STREAM_DATA frame with a large stream index. This causes the endpoint to implicitly open all streams up to that index, potentially exhausting memory or causing denial of service. The issue does not affect unidirectional streams. The flaw is fixed in version 0.11.19.
References
- crates.io/crates/quinn-proto (opens in a new tab)
- rustsec.org/advisories/RUSTSEC-2026-0523.html (opens in a new tab)
- github.com/quinn-rs/quinn/commit/3eb7465d9e11d7a245e99cde1a4eb872ec26d264 (opens in a new tab)
- github.com/quinn-rs/quinn/commit/73114d8289d42bd536c790fa00a9beed05a4e5fa (opens in a new tab)