{"cve":"CVE-2026-25800","nvd":{"published":"2026-07-23T20:17:07.860","modified":"2026-10-24T13:10:00.147","status":"Deferred","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-770"],"references":["https://github.com/quinn-rs/quinn/pull/2694","https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j","https://rustsec.org/advisories/RUSTSEC-2026-0185.html"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:27.712498749+00:00"},"epss":{"cve":"CVE-2026-25800","score":0.00841,"percentile":0.57613,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-4w2j-m93h-cj5j","url":"https://osv.dev/vulnerability/GHSA-4w2j-m93h-cj5j","summary":"Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","modified":"2026-09-10T03:51:10.288925502Z","packages":[{"ecosystem":"crates.io","name":"quinn-proto","purl":"pkg:cargo/quinn-proto","ranges":[">=0.1.0 <0.11.15"],"fixed":["0.11.15"]}]},{"id":"RUSTSEC-2026-0185","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0185","summary":" Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","modified":"2026-10-12T18:27:06.855127585Z","packages":[{"ecosystem":"crates.io","name":"quinn-proto","purl":"pkg:cargo/quinn-proto","ranges":[">=0.0.0-0 <0.11.15"],"fixed":["0.11.15"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}