VYPR
← All advisories
High severityNVD Advisory· Published Mar 10, 2026· Updated Apr 16, 2026

CVE-2026-31812

CVE-2026-31812

Description

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
quinn-protocrates.io
< 0.11.140.11.14

Affected products

88

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.