A vulnerability in quinn-proto versions 0.11.0 through 0.11.18 allows a peer to open an excessive number of bidirectional streams by sending a MAX_STREAM_DATA frame with a large stream index. This causes the endpoint to implicitly open all streams up to that index, potentially exhausting memory or causing denial of service. The issue does not affect unidirectional streams. The flaw is fixed in version 0.11.19.