{"id":"RUSTSEC-2026-0343","summary":"Outgoing datagram buffer accounting can panic the sender in quinn-proto","details":"The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an\nevicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called\nwith `drop = true` (as `Connection::send_datagram` in the `quinn` crate does) while the buffer was\nfull. Under sustained eviction the counter drifts below its true value: debug builds panic with an\ninteger underflow, while release builds wrap the counter, drain the whole queue, and then panic on\na desynchronization check in a later `send` call. In `quinn`, this panic occurs while the\nconnection lock is held, poisoning it and causing a double panic (and thus an abort) when the\nconnection is dropped.\n\nThis can be triggered without a malicious peer, by an application that sends a burst of datagrams\nand then idles. It can also be triggered by a peer that keeps the connection alive with PING frames\nwhile withholding acknowledgements, so that the sender's congestion window stays closed and the\noutgoing queue never drains. Applications that use `send_datagram_wait` are not affected.\n\nOnly 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.\n\nThanks to [@alexpyattaev](https://github.com/alexpyattaev) for reporting and\n[@vcarus](https://github.com/vcarus) for fixing this issue.","aliases":["GHSA-ppcp-v39w-8jq2"],"modified":"2026-10-12T18:15:01.961745820Z","published":"2026-09-14T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/quinn-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0343.html"},{"type":"WEB","url":"https://github.com/quinn-rs/quinn/pull/2806"}],"affected":[{"package":{"name":"quinn-proto","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.17"},{"fixed":"0.11.18"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":[]},"affected_functions":null},"database_specific":{"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","informational":null,"categories":["denial-of-service"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0343.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}