RUSTSEC-2026-0338: Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
- Domain
- networking, security
Research direction
The report describes a panic in quinn-proto's RangeSet::replace while processing zero-length STREAM frames during unordered reads; it does not identify files or tests in this repository. Start by checking whether this gateway uses the affected quinn-proto version and tracing its dependency path. The advisory says the fix is in version 0.11.18; done means confirming the affected dependency is addressed and unordered reads no longer panic.
Written by the indexing model from the issue text.
Description
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
| Details | |
|---|---|
| Package | quinn-proto |
| Version | 0.11.17 |
| URL | https://github.com/quinn-rs/quinn/pull/2868 |
| Date | 2026-09-14 |
| Patched versions | >=0.11.18 |
| Unaffected versions | <0.7.0 |
When a stream is read in unordered mode (for example through RecvStream::read(false) in
quinn-proto or read_unordered in quinn), quinn-proto proactively deduplicates received data
by recording received ranges in a RangeSet through its replace method. When an incoming
STREAM frame carried an empty payload, the Drop implementation of the iterator returned by
replace inserted an empty range into the set, violating the invariant that stored ranges are
non-empty. Subsequent frames overlapping that region then caused a panic while processing the
stream.
A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the
application has put the stream in unordered-read mode. The default ordered read path is not
affected.
The flaw was corrected in 0.11.18 by ignoring empty ranges in RangeSet::replace.
Thanks to Otto Hermann (@ojhermann) for reporting this issue.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 0
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/postgresql-trino-gateway
-
RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authenticationOpen
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 4/5 3-5 days Newbie friendliness 47/100
-
Difficulty 1/5 Under an hour Newbie friendliness 55/100
All issues in stackabletech/postgresql-trino-gateway
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
pop-os/cosmic-comp#2956 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
area:release criticality:p3 documentation
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
registrystack/registry-stack#2085 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
libp2p/rust-libp2p#6694 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
EmbarkStudios/cargo-deny#910 ·