CVE-2026-25800: Quinn-proto Remote Memory Exhaustion Due to Unbounded Out-of-Order Stream Reassembly
Summary
CVE-2026-25800: Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly. Affects quinn-proto versions >= 0.1.0, < 0.11.15. Fixed in 0.11.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Quinn-proto is a Rust library that implements the QUIC transport protocol, designed to provide a secure and efficient way to transmit data over the internet. It is widely used in applications requiring low-latency communication. However, its Assembler component can be exploited when peers send unordered stream fragments, leading to potential memory exhaustion issues.
Vulnerability Detail
The vulnerability arises from the Assembler component's handling of unordered stream fragments. When a receiving connection processes fragments that leave out early parts of the stream, it can lead to high buffer overhead. This situation is exacerbated when many gaps exist in the fragments, as they cannot be defragmented. Consequently, this can result in remote memory exhaustion, affecting the stability and performance of applications using the quinn-proto library.
How To Fix
Minimum fixed version
0.11.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on the sending side to reduce the frequency of fragment transmission. This can help mitigate the impact of unordered fragments until the package is updated.
Conclusion
The CVE-2026-25800 vulnerability in the quinn-proto library poses a significant risk of remote memory exhaustion due to improper handling of unordered stream fragments. It is crucial to update to version 0.11.15 or later to mitigate this risk and ensure the stability of applications using this library.
See every vulnerability recorded for quinn-proto →
FAQ
CVE-2026-25800 is a vulnerability in the quinn-proto library that allows for remote memory exhaustion due to unbounded out-of-order stream reassembly.
If your application uses quinn-proto, it may experience performance degradation or crashes due to excessive memory usage when handling unordered stream fragments.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing rate limiting on the sending side to reduce the impact of unordered fragments until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for quinn-proto.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
