CVE-2026-25800

HighCVSS 7.5

Published: 23/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

In the Quinn library (a Rust implementation of the QUIC protocol), a vulnerability exists in the Assembler component that reassembles unordered stream fragments. An attacker can send fragments with many gaps, causing excessive buffering and memory exhaustion.

Risk Assessment

The organization is at risk of a denial-of-service (DoS) attack via memory exhaustion on servers or clients using the vulnerable Quinn version.

Recommendation

Immediately update the Quinn library to version 0.11.15 or later.

Other vulnerabilities in Quinn

CVE-2026-31812Medium
A vulnerability in Quinn before version 0.11.14 allows a remote, unauthenticated attacker to trigger a denial of service (DoS) by sending a crafted QUIC Initial packet with malformed transport parameters. The flaw is due to the use of unwrap() when decoding varints, causing a panic on truncated encoding.

Original NVD description (English source)

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.