quinn project vulnerabilities

Products

• quinn 3

Latest quinn project CVEs

Newest publication first

1. CVE-2024-45311 Denial of service in quinn-proto when using `Endpoint::retry()`

   Published 2024-09-02

   High·CVSS 7.5 EPSS 0.57%

   Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the ser...

2. CVE-2023-42805 quinn-proto Denial of Service vulnerability

   Published 2023-09-21

   High·CVSS 7.5 EPSS 0.94%

   quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

3. CVE-2021-28036 quinn invalidly assumes the memory layout of std::net::SocketAddr

   Published 2021-03-05

   High·CVSS 7.5 EPSS 1.3%

   An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.