Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

RUSTSEC-2026-0343: Outgoing datagram buffer accounting can panic the sender in quinn-proto

Aperta
  • Qualcosa non va?
#308 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
Meno di un'ora
Idoneità per principianti
15/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
networking

Direzione di ricerca

The payload names no files in this repository. Start by checking whether Cargo.lock resolves quinn-proto to 0.11.17, which the advisory says is the only affected version, and whether any Cargo.toml depends on it directly or through quinn. Done means the lockfile resolves quinn-proto at 0.11.18 or later and the project's tests still pass. Confirm with a maintainer that this is the intended fix before starting.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Outgoing datagram buffer accounting can panic the sender in quinn-proto

Details
Package quinn-proto
Version 0.11.17
URL https://github.com/quinn-rs/quinn/pull/2806
Date 2026-09-14
Patched versions >=0.11.18
Unaffected versions <0.11.17

The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an
evicted datagram's size from the buffered byte counter twice when Datagrams::send was called
with drop = true (as Connection::send_datagram in the quinn crate does) while the buffer was
full. Under sustained eviction the counter drifts below its true value: debug builds panic with an
integer underflow, while release builds wrap the counter, drain the whole queue, and then panic on
a desynchronization check in a later send call. In quinn, this panic occurs while the
connection lock is held, poisoning it and causing a double panic (and thus an abort) when the
connection is dropped.

This can be triggered without a malicious peer, by an application that sends a burst of datagrams
and then idles. It can also be triggered by a peer that keeps the connection alive with PING frames
while withholding acknowledgements, so that the sender's congestion window stays closed and the
outgoing queue never drains. Applications that use send_datagram_wait are not affected.

Only 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.

Thanks to @alexpyattaev for reporting and
@vcarus for fixing this issue.

See advisory page for additional details.

Lingua principale
Rust
Stelle
1
Fork
2
Merge medio
14g 15h
PR unite (30g)
1

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di DiamondLightSource/numtracker

Tutte le issue di DiamondLightSource/numtracker

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.