RUSTSEC-2026-0538: Receive loop can spin after a truncated datagram
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- Under an hour
- Newbie friendliness
- 50/100
Research direction
The advisory concerns the quinn-udp crate pinned at 0.5.14 in this project's dependency graph. Start by finding its entry in the lockfile and checking whether it comes in directly or through another crate. Update it to a patched version (0.5.16 or later on the 0.5 line, or 0.6.3 or later on the 0.6 line), then build and run the test suite to confirm it resolves cleanly. Done when the lockfile shows a patched version and the build and tests pass.
Written by the indexing model from the issue text.
Description
Receive loop can spin after a truncated datagram
| Details | |
|---|---|
| Package | quinn-udp |
| Version | 0.5.14 |
| URL | https://github.com/quinn-rs/quinn/commit/462865a6c33039c26076f7077c7cd7e2f997b9cd |
| Date | 2026-09-30 |
| Patched versions | >=0.5.16, <0.6.0,>=0.6.3 |
Some targets read one datagram per recvmsg call instead of using recvmmsg: Apple platforms without the fast-apple-datapath feature, OpenBSD, NetBSD, Solaris and illumos, and from 0.6 also DragonFly BSD, Redox and GNU/Hurd. On these targets the receive loop set up its msghdr only once and looked at the MSG_TRUNC flag before checking whether recvmsg had failed. After a datagram larger than the receive buffer was dropped, a following EAGAIN still saw the old truncation flag. The loop then kept issuing non-blocking receives instead of returning WouldBlock.
When the receive buffer is smaller than a datagram that arrives, a remote sender can keep the task that drives the socket busy, before any QUIC packet authentication. The loop ends only when a later datagram fits in the buffer. Whether an application is exposed therefore depends on the receive buffer size it uses. Linux, Android, FreeBSD and Windows use other receive paths and are not affected.
The fix rebuilds the header before every recvmsg call and returns receive errors before checking the truncation flag. It is in 0.5.16 and 0.6.3.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 0
- Forks
- 2
- Avg merge
- 14d 2h
- Merged PRs (30d)
- 1
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/postgresql-trino-gateway
-
Difficulty 1/5 Under an hour Newbie friendliness 62/100
-
RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authenticationOpen
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 48/100
All issues in stackabletech/postgresql-trino-gateway
Similar issues
-
bug UI
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
wardian-app/Wardian#1746 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
jlcodes99/cockpit-tools#3125 ·
Maintainers usually reply within 2 days
-
bug user-sprint
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Vondor/KassenSturz#967 ·
Maintainers usually reply within 1 day