CVE-2026-31812

Fixed in a distro release EPSS <1%CVSS 8.7

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.

Published 2026-03-10 · CVE record · OSV

Products: quinn-rs quinn, Logging Subsystem for Red Hat OpenShift 6.4, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat Trusted Artifact Signer 1.3, Red Hat Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Update Service, Red Hat Trusted Profile Analyzer

Fixed upstream

Distro releases