Skip to main content
VulnerabilityPublished Updated

Quinn udp: Receive loop can spin after a truncated datagram

Affects quinn-udpSource GCVE Database

0
Severity
Medium

Rated Medium by Threat Radar's AI analysis

Patch
Available – fixed in 0.6.3, 0.5.16

Data as of 13 Nov 2026, 13:12 UTC

What to do

Upgrade quinn-udp to 0.6.3 or 0.5.16.

Affected software

ProductAffectedFixed in
crates.ioquinn-udppkg:cargo/quinn-udpOther threatsAffected
  • >=0.0.0-0 <0.5.16
  • >=0.6.0 <0.6.3
Fixed in
  • 0.5.16
  • 0.6.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Upgrade quinn-udp to version 0.5.16 or later in the 0.5.x series, or 0.6.3 or later in the 0.6.x series to apply the fix. The fix rebuilds the message header before each recvmsg call and properly handles receive errors before checking the truncation flag, preventing the receive loop from spinning.

Description

A vulnerability in quinn-udp's receive loop can cause it to spin indefinitely after receiving a truncated datagram when the receive buffer is smaller than the incoming datagram. This affects certain platforms that read one datagram per recvmsg call and do not rebuild the message header on each call, causing the loop to repeatedly issue non-blocking receives without returning a WouldBlock error. The issue is fixed in versions 0.5.16 and 0.6.3.

References

Community reviews

Loading reviews…