CVE-2026-25800 | Quinn is a pure-Rust, async-compatible implementation of the… | CVSS 7.5 HIGH

Description

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.

Metadata

CVE ID: CVE-2026-25800
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-02-05 19:58 UTC
Published: 2026-07-23 19:09 UTC
Last updated: 2026-07-23 19:37 UTC
Primary CWE: CWE-770
CWE-770: Allocation of Resources Without Limits or Throttlin…
Vendor / Product: quinn-rs / quinn
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
quinn-rs	quinn	—	>= 0.1.0, < 0.11.15

Weakness (CWE)

CWE	Source	Description
CWE-770	cna	CWE-770: Allocation of Resources Without Limits or Throttling

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (3)

https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j
https://github.com/quinn-rs/quinn/pull/2694 https://github.com/quinn-rs/quinn/pull/2694
https://rustsec.org/advisories/RUSTSEC-2026-0185.html https://rustsec.org/advisories/RUSTSEC-2026-0185.html