CVE-2026-25800

Received Received - Intake

Memory Exhaustion in Quinn QUIC Protocol Implementation

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: GitHub, Inc.

Description

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-25800

EUVD

EUVD-2026-48374

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory exhaustion issue in the Quinn library, specifically in its QUIC protocol implementation. It occurs in the Assembler component which handles out-of-order stream fragments. Attackers can exploit this by sending fragmented data with many gaps, preventing proper reassembly and causing excessive memory usage on the receiving system.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory usage or network traffic patterns in systems using the Quinn library. Check for processes using quinn-proto versions before 0.11.15. Use commands like 'cargo tree' to inspect dependency versions or 'ps aux' to monitor memory-intensive processes. Network monitoring tools may detect excessive QUIC traffic with fragmented streams.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by exhausting system memory. It affects availability of services using vulnerable Quinn versions, potentially causing crashes or degraded performance. No special privileges or user interaction are required for exploitation.

Mitigation Strategies

Immediately update the quinn-proto crate to version 0.11.15 or later. If using Rust projects, run 'cargo update -p quinn-proto'. For systems using Quinn, verify all dependencies are updated. Monitor memory usage and network traffic for signs of exploitation. Consider temporarily disabling QUIC services if updates cannot be applied promptly.

Hi! I’m here to help you understand CVE-2026-25800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70