GothenburgBitFactory / GothenburgBitFactory/taskwarrior
RUSTSEC-2026-0037: Denial of service in Quinn endpoints
- Dominant language
- C++
- Stars
- 6.1k
- Forks
- 423
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 11
Description
> Denial of service in Quinn endpoints
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `quinn-proto` |
| Version | `0.11.13` |
| URL | [https://github.com/quinn-rs/quinn/pull/2559](https://github.com/quinn-rs/quinn/pull/2559) |
| Date | 2026-03-09 |
| Patched versions | `>=0.11.14` |
| Unaffected versions | `<0.5.0` |
Receiving QUIC transport parameters containing invalid values could lead to a panic.
Unfortunately the maintainers did not properly assess usage of `unwrap()` calls in the
transport parameters parsing code, and we did not have sufficient fuzzing coverage to find this
issue. We have since added a fuzzing target to cover this code path.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0037.html) for additional details.
Contributor guide
Assessment
This issue has not been assessed yet.