Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

RUSTSEC-2026-0341: Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

Ouverte
  • Quelque chose ne va pas ?
#14 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
30/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
rust
Domaine
security

Piste de recherche

The advisory identifies the affected component as quinn-proto's stream Assembler and links to the fix in quinn-rs/quinn pull request 2790; this issue names no repository files or tests. Read that change and the RUSTSEC-2026-0185 fix to understand the guard and its bypass. Done means the chunk cap is checked after every insert, including unordered deduplication, and excessive chunks are compacted or rejected as described.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

Details
Package quinn-proto
Version 0.11.16
URL https://github.com/quinn-rs/quinn/pull/2790
Date 2026-08-17
Patched versions >=0.11.17
Unaffected versions <0.11.15

The fix for RUSTSEC-2026-0185 in 0.11.15 added a cap on the number of chunks buffered by the
Assembler that reassembles out-of-order stream data. However, the cap was only checked inside
the branch that triggers defragmentation, which only runs when the estimated over-allocation
exceeds a threshold proportional to the amount of buffered data. Frames handled entirely by the
unordered-read deduplication loop returned before the check ran at all.

A peer sending one small gapped STREAM frame per packet (for example, 6-byte frames separated by
1-byte gaps) keeps the per-chunk overhead below the defragmentation threshold, so the cap is never
evaluated and the chunk count grows until stream-level flow control stops the peer. With the default
TransportConfig (100 concurrent unidirectional streams and a 1.25 MB stream receive window), a
remote, unauthenticated peer can pin roughly 3 GB of receiver memory using about 125 MB of accounted
stream data. The memory is not reclaimed until the affected streams or the connection are closed.

The flaw was corrected in 0.11.17 by checking the chunk count after every insert (including in the
unordered deduplication loop) and compacting the buffer once it passes a watermark above the cap.
A stream is rejected once compaction can no longer bring the chunk count back under the cap.

Versions before 0.11.15 are affected by the original, broader issue described in RUSTSEC-2026-0185.

Thanks to Otto Hermann (@ojhermann) for reporting and fixing
this issue.

See advisory page for additional details.

Langage dominant
Rust
Étoiles
1
Forks
0
Merge moyen
1 j 15 h
PR mergées (30 j)
3

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de stackabletech/stackable-odbc-trino

Toutes les issues de stackabletech/stackable-odbc-trino

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.