{"id":"CVE-2026-25800","title":"quinn: Quinn: Remote memory exhaustion via malformed QUIC stream fragments (CVE-2026-25800)","summary":"A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in t…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"quinn-proto","affected":["quinn-proto >= 0.0.0-0, < 0.11.15"],"patched":["quinn-proto 0.11.15"],"published":"2026-07-23","updated":"2026-10-15","sourceUpdated":"2026-10-15T10:45:47+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25800.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25800.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-25800"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506588"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25800"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25800"},{"url":"https://github.com/quinn-rs/quinn/pull/2694"},{"url":"https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0185.html"},{"url":"https://crates.io/crates/quinn-proto"},{"url":"https://github.com/quinn-rs/quinn/commit/fed0321a9a672819662caab37f5662f1ad91308e"},{"url":"https://github.com/quinn-rs/quinn"},{"url":"https://github.com/quinn-rs/quinn/releases/tag/quinn-proto-0.11.15"}],"tags":["csaf","vex","red-hat","osv","rust"],"epss":0.00841,"epssPercentile":0.57688,"aliases":["RUSTSEC-2026-0185","GHSA-4w2j-m93h-cj5j"],"ecosystem":"rust","ingestedAt":"2026-07-24T19:07:03.673Z","slug":"CVE-2026-25800","body":"## Overview\n\nA flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in the Assembler component, causing memory exhaustion and a denial of service (DoS) for the receiving connection.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25800.json)\n\n**quinn: Quinn: Remote memory exhaustion via malformed QUIC stream fragments** — rated Important by Red Hat. Released 2026-07-23, updated 2026-10-15.\n\nNot affected:\n\n- Ansible Automation Orchestrator 2026\n- Confidential Compute Attestation\n- Logging Subsystem for Red Hat OpenShift\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\n## Remediation\n\nRefer to the advisory for fix availability.\n\n## Package advisory (CVE-2026-25800)\n\nAffected packages:\n\n- `quinn-proto >= 0.0.0-0, < 0.11.15`\n\nPatched in:\n\n- `quinn-proto 0.11.15`\n\nSource: https://osv.dev/vulnerability/RUSTSEC-2026-0185","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}