Bug 2506588 (CVE-2026-25800)

Summary: CVE-2026-25800 quinn: Quinn: Remote memory exhaustion via malformed QUIC stream fragments
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, aprice, aruklets, asdas, bbrownin, bparees, dbosanac, doconnor, dpaolell, dschmidt, eborisov, gbenhaim, gotiwari, hasun, jcantril, jdelft, jfula, jhorak, jlanda, jowilson, jreimann, jsamir, jupierce, kshier, lball, lgarciaa, mbiarnes, mdessi, mrizzi, mvyas, ngough, niyer, nyancey, oezr, ometelka, pcattana, ppalepu, ppostler, prdhamdh, ptisnovs, rekumar, rhel-process-autobot, rojacob, sghai, sidsharm, simaishi, stcannon, suppawar, syedriko, teagle, twaugh, veshanka, vlaad, vvoronko, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in the Assembler component, causing memory exhaustion and a denial of service (DoS) for the receiving connection.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2524243, 2524244    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-23 20:02:15 UTC 
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.