PT-2026-64151 · Quinn · Quinn

CVE-2026-25800 · Published 2026-06-22 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Quinn versions 0.1.0 through 0.11.14

Description The Assembler component, which organizes unordered stream fragments into consecutive chunks, incurs significant overhead when processing non-contiguous fragments. When a reader accesses a RecvStream in order, the system becomes sensitive to peers that send fragments with numerous gaps, as these cannot be defragmented. This behavior leads to high buffer overhead on the receiving connection, which can result in memory exhaustion.

Recommendations Update to version 0.11.15.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-25800

GHSA-4W2J-M93H-CJ5J

RUSTSEC-2026-0185

Affected Products

Quinn

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25800.json · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2026-0185 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25800 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4w2j-m93h-cj5j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25800 · Security Note
• https://github.com/quinn-rs/quinn · Note
• https://github.com/quinn-rs/quinn/pull/2694 · Note
• https://github.com/quinn-rs/quinn/releases/tag/quinn-proto-0.11.15 · Note
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j · Note
• https://github.com/quinn-rs/quinn/commit/fed0321a9a672819662caab37f5662f1ad91308e · Note
• https://crates.io/crates/quinn-proto · Note
• https://rustsec.org/advisories/RUSTSEC-2026-0185.html · Note