CVE-2023-42805: quinn-proto Denial of Service vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-21 · updated 2026-06-17
Weakness: CWE-20

Description

quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

Affected products

quinn-rs quinn: before 0.9.5; from 0.10.0 before 0.10.5 — fixed in 0.10.5, 0.9.5

How to fix

Upgrade to a fixed version: quinn-rs quinn 0.10.5, 0.9.5. Check the vendor advisory for mitigations.

References

https://github.com/quinn-rs/quinn/pull/1667
https://github.com/quinn-rs/quinn/pull/1668
https://github.com/quinn-rs/quinn/pull/1669
https://github.com/quinn-rs/quinn/security/advisories/GHSA-q8wc-j5m9-27w3
https://github.com/quinn-rs/quinn/pull/1667
https://github.com/quinn-rs/quinn/pull/1668
https://github.com/quinn-rs/quinn/pull/1669
https://github.com/quinn-rs/quinn/security/advisories/GHSA-q8wc-j5m9-27w3

Get alerted when CVE-2023-42805 or the next vulnerability affects your stack