---
id: RUSTSEC-2026-0338
aliases:
  - GHSA-465w-v9q3-7j98
title: >-
  Remote peer can panic quinn-proto with zero-length STREAM frames during
  unordered reads
summary: >-
  Remote peer can panic quinn-proto with zero-length STREAM frames during
  unordered reads
severity: none
vendor: quinn-proto
product: quinn-proto
ecosystem: rust
affected:
  - 'quinn-proto >= 0.7.0, < 0.11.18'
patched:
  - quinn-proto 0.11.18
published: '2026-09-14'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:15:01.969514645Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0338'
references:
  - url: 'https://crates.io/crates/quinn-proto'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0338.html'
  - url: 'https://github.com/quinn-rs/quinn/pull/2868'
tags:
  - osv
  - rust
ingestedAt: '2026-10-13T11:45:30.199Z'
---

## Overview

When a stream is read in unordered mode (for example through `RecvStream::read(false)` in
quinn-proto or `read_unordered` in `quinn`), quinn-proto proactively deduplicates received data
by recording received ranges in a `RangeSet` through its `replace` method. When an incoming
STREAM frame carried an empty payload, the `Drop` implementation of the iterator returned by
`replace` inserted an empty range into the set, violating the invariant that stored ranges are
non-empty. Subsequent frames overlapping that region then caused a panic while processing the
stream.

A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the
application has put the stream in unordered-read mode. The default ordered read path is not
affected.

The flaw was corrected in 0.11.18 by ignoring empty ranges in `RangeSet::replace`.

Thanks to Otto Hermann ([@ojhermann](https://github.com/ojhermann)) for reporting this issue.

## Affected packages

- `quinn-proto >= 0.7.0, < 0.11.18`

## Remediation

Upgrade to a patched release:

- `quinn-proto 0.11.18`