Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

RUSTSEC-2026-0341: Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

Abierto
  • ¿Algo no está bien?
#14 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
30/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rust
Área
security

Línea de trabajo

The advisory identifies the affected component as quinn-proto's stream Assembler and links to the fix in quinn-rs/quinn pull request 2790; this issue names no repository files or tests. Read that change and the RUSTSEC-2026-0185 fix to understand the guard and its bypass. Done means the chunk cap is checked after every insert, including unordered deduplication, and excessive chunks are compacted or rejected as described.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

Details
Package quinn-proto
Version 0.11.16
URL https://github.com/quinn-rs/quinn/pull/2790
Date 2026-08-17
Patched versions >=0.11.17
Unaffected versions <0.11.15

The fix for RUSTSEC-2026-0185 in 0.11.15 added a cap on the number of chunks buffered by the
Assembler that reassembles out-of-order stream data. However, the cap was only checked inside
the branch that triggers defragmentation, which only runs when the estimated over-allocation
exceeds a threshold proportional to the amount of buffered data. Frames handled entirely by the
unordered-read deduplication loop returned before the check ran at all.

A peer sending one small gapped STREAM frame per packet (for example, 6-byte frames separated by
1-byte gaps) keeps the per-chunk overhead below the defragmentation threshold, so the cap is never
evaluated and the chunk count grows until stream-level flow control stops the peer. With the default
TransportConfig (100 concurrent unidirectional streams and a 1.25 MB stream receive window), a
remote, unauthenticated peer can pin roughly 3 GB of receiver memory using about 125 MB of accounted
stream data. The memory is not reclaimed until the affected streams or the connection are closed.

The flaw was corrected in 0.11.17 by checking the chunk count after every insert (including in the
unordered deduplication loop) and compacting the buffer once it passes a watermark above the cap.
A stream is rejected once compaction can no longer bring the chunk count back under the cap.

Versions before 0.11.15 are affected by the original, broader issue described in RUSTSEC-2026-0185.

Thanks to Otto Hermann (@ojhermann) for reporting and fixing
this issue.

See advisory page for additional details.

Lenguaje dominante
Rust
Estrellas
1
Forks
0
Merge medio
11 h 44 min
PR fusionados (30 d)
2

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stackabletech/stackable-odbc-trino

Todos los issues de stackabletech/stackable-odbc-trino

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.