Bug 2446330 (CVE-2026-31812)

Summary:	CVE-2026-31812 quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bbrownin, dbosanac, dschmidt, erezende, gotiwari, jcantril, jgrulich, jhorak, jkoehler, jlanda, jreimann, kshier, lball, lphiri, mdessi, mrizzi, mvyas, ngough, pcattana, rojacob, simaishi, smcdonal, stcannon, teagle, tpopela, veshanka, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in quinn-proto, a pure-Rust implementation of the IETF QUIC transport protocol. A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2446360, 2446361, 2446362, 2446363, 2446364, 2446365, 2446366, 2446370, 2446371, 2446372, 2446373, 2446374, 2446376, 2446354, 2446355, 2446356, 2446357, 2446358, 2446359, 2446367, 2446368, 2446369, 2446375
Bug Blocks:

Description OSIDB Bzimport 2026-03-10 23:02:38 UTC

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.