RUSTSEC-2026-0524: Long Retry token can panic or exhaust memory in a QUIC client
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 62/100
Research direction
The vulnerable crate is quinn-proto at 0.11.17, and the fix is to reach 0.11.19 or later. Check Cargo.lock for the locked version and run cargo tree -i quinn-proto to see which dependency pulls it in. Then run cargo update -p quinn-proto (or bump the parent crate if it is pinned) and rebuild. Done when the lockfile shows 0.11.19+ and cargo build and cargo test pass.
Written by the indexing model from the issue text.
Description
Long Retry token can panic or exhaust memory in a QUIC client
| Details | |
|---|---|
| Package | quinn-proto |
| Version | 0.11.17 |
| URL | https://github.com/quinn-rs/quinn/commit/3bba467893ceff64d6cda0b3a2c51a1429e10372 |
| Date | 2026-09-30 |
| Patched versions | >=0.11.19 |
| Unaffected versions | <0.11.0 |
A client kept the token from a Retry packet without any length limit and put it into the header of every Initial packet it sent afterwards. Initial datagrams are 1200 bytes. When the token and connection IDs left no room for the minimum payload, PacketBuilder::new computed a minimum packet size larger than the maximum, which only a debug assertion checked. On the next poll_transmit, debug builds panic, and release builds try to allocate more than 10 GiB in one call. With longer tokens the allocation fails and the process aborts.
A matching Retry packet can be built from the client's first Initial alone. The attacker can therefore be the server being contacted, or anyone who sees that Initial and can answer before the server does. Every application that makes outgoing connections with quinn-proto is affected, including all quinn clients. Servers do not process Retry packets.
The fix closes the connection with PROTOCOL_VIOLATION when an Initial token leaves too little room for frames. That covers Retry tokens and cached address-validation tokens, since both come from the peer. It also reserves room for CONNECTION_CLOSE after large Initial headers. Both changes are in 0.11.19.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 0
- Forks
- 2
- Avg merge
- 14d 2h
- Merged PRs (30d)
- 1
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/postgresql-trino-gateway
-
RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authenticationOpen
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 Under an hour Newbie friendliness 50/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 48/100
All issues in stackabletech/postgresql-trino-gateway
Similar issues
-
bug UI
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
wardian-app/Wardian#1746 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
jlcodes99/cockpit-tools#3125 ·
Maintainers usually reply within 2 days
-
bug user-sprint
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Vondor/KassenSturz#967 ·
Maintainers usually reply within 1 day