Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

RUSTSEC-2026-0343: Outgoing datagram buffer accounting can panic the sender in quinn-proto

Abierto
  • ¿Algo no está bien?
#308 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
Menos de una hora
Aptitud para principiantes
15/100
Tipo de issue
Error
Claridad
Necesita aclaración
Estado de actividad
Activo
Stack tecnológico
rust
Área
networking

Línea de trabajo

The payload names no files in this repository. Start by checking whether Cargo.lock resolves quinn-proto to 0.11.17, which the advisory says is the only affected version, and whether any Cargo.toml depends on it directly or through quinn. Done means the lockfile resolves quinn-proto at 0.11.18 or later and the project's tests still pass. Confirm with a maintainer that this is the intended fix before starting.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Outgoing datagram buffer accounting can panic the sender in quinn-proto

Details
Package quinn-proto
Version 0.11.17
URL https://github.com/quinn-rs/quinn/pull/2806
Date 2026-09-14
Patched versions >=0.11.18
Unaffected versions <0.11.17

The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an
evicted datagram's size from the buffered byte counter twice when Datagrams::send was called
with drop = true (as Connection::send_datagram in the quinn crate does) while the buffer was
full. Under sustained eviction the counter drifts below its true value: debug builds panic with an
integer underflow, while release builds wrap the counter, drain the whole queue, and then panic on
a desynchronization check in a later send call. In quinn, this panic occurs while the
connection lock is held, poisoning it and causing a double panic (and thus an abort) when the
connection is dropped.

This can be triggered without a malicious peer, by an application that sends a burst of datagrams
and then idles. It can also be triggered by a peer that keeps the connection alive with PING frames
while withholding acknowledgements, so that the sender's congestion window stays closed and the
outgoing queue never drains. Applications that use send_datagram_wait are not affected.

Only 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.

Thanks to @alexpyattaev for reporting and
@vcarus for fixing this issue.

See advisory page for additional details.

Lenguaje dominante
Rust
Estrellas
1
Forks
2
Merge medio
14 d 15 h
PR fusionados (30 d)
1

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de DiamondLightSource/numtracker

Todos los issues de DiamondLightSource/numtracker

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.