---
id: RUSTSEC-2026-0343
aliases:
  - GHSA-ppcp-v39w-8jq2
title: Outgoing datagram buffer accounting can panic the sender in quinn-proto
summary: Outgoing datagram buffer accounting can panic the sender in quinn-proto
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: quinn-proto
product: quinn-proto
ecosystem: rust
affected:
  - 'quinn-proto >= 0.11.17, < 0.11.18'
patched:
  - quinn-proto 0.11.18
published: '2026-09-14'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:15:01.961745820Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0343'
references:
  - url: 'https://crates.io/crates/quinn-proto'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0343.html'
  - url: 'https://github.com/quinn-rs/quinn/pull/2806'
tags:
  - osv
  - rust
ingestedAt: '2026-10-13T11:45:30.201Z'
---

## Overview

The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an
evicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called
with `drop = true` (as `Connection::send_datagram` in the `quinn` crate does) while the buffer was
full. Under sustained eviction the counter drifts below its true value: debug builds panic with an
integer underflow, while release builds wrap the counter, drain the whole queue, and then panic on
a desynchronization check in a later `send` call. In `quinn`, this panic occurs while the
connection lock is held, poisoning it and causing a double panic (and thus an abort) when the
connection is dropped.

This can be triggered without a malicious peer, by an application that sends a burst of datagrams
and then idles. It can also be triggered by a peer that keeps the connection alive with PING frames
while withholding acknowledgements, so that the sender's congestion window stays closed and the
outgoing queue never drains. Applications that use `send_datagram_wait` are not affected.

Only 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.

Thanks to [@alexpyattaev](https://github.com/alexpyattaev) for reporting and
[@vcarus](https://github.com/vcarus) for fixing this issue.

## Affected packages

- `quinn-proto >= 0.11.17, < 0.11.18`

## Remediation

Upgrade to a patched release:

- `quinn-proto 0.11.18`