CVE-2026-31812

Name of the Vulnerable Software and Affected Versions quinn versions prior to 0.11.14

Description A remote, unauthenticated attacker can trigger a denial of service in applications using the quinn-proto QUIC transport protocol implementation. The issue occurs when a crafted QUIC Initial packet containing malformed quic transport parameters is sent to the application. Within the parsing logic of quinn-proto, attacker-controlled varints (variable-length integers) are decoded using the unwrap() function. If the encodings are truncated, it results in an Err(UnexpectedEnd) and causes the application to panic and crash. This can be achieved over the network with a single packet without requiring prior trust or authentication.

Recommendations Update to version 0.11.14.