Security vulnerabilities and automated fixes for quic issues
3 posts found
A high-severity vulnerability (GHSA-4w2j-m93h-cj5j) in `quinn-proto`, the QUIC protocol implementation underlying the Quinn library, allowed remote attackers to exhaust server memory by sending unbounded out-of-order stream data. The `crosshash` project's `Cargo.lock` pinned the vulnerable `quinn-proto` 0.11.14; upgrading to 0.11.15 closes the gap by bounding how much out-of-order stream data the reassembly buffer will retain.
A high-severity vulnerability in `quinn-proto` 0.11.14 allowed remote attackers to exhaust server memory by sending deliberately out-of-order QUIC stream data, triggering unbounded buffer growth during reassembly. The fix upgrades `quinn-proto` to 0.11.15, which enforces limits on the reassembly buffer, preventing this denial-of-service attack vector. This patch was applied to the `src/Tauri/src-tauri/Cargo.lock` dependency lockfile in a Tauri desktop application.
A high-severity vulnerability in `quinn-proto` allowed remote attackers to exhaust server memory by sending carefully crafted out-of-order QUIC stream data, triggering unbounded buffer growth during reassembly. The fix upgrades `rustls-webpki` from `0.103.10` to `0.103.13` in `Cargo.lock`, closing a related denial-of-service primitive that could be chained with the stream reassembly weakness. Together, these changes harden the QUIC stack against memory exhaustion attacks that require no authenti