1 line
2.1 KiB
JSON
1 line
2.1 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0523","published":"2026-09-30T12:00:00Z","modified":"2026-11-13T12:45:04.789912316Z","aliases":["GHSA-53rm-773f-4q8c"],"summary":"MAX_STREAM_DATA frame can open streams beyond the stream limit","details":"When a MAX_STREAM_DATA frame named a peer-initiated bidirectional stream that was not open yet, `received_max_stream_data` treated the stream, and every lower-numbered stream, as opened without checking the stream ID against the limit advertised to the peer. RFC 9000 section 4.6 requires closing the connection with `STREAM_LIMIT_ERROR` in this case, and the STREAM and RESET_STREAM handlers already did so.\n\nAfter the handshake, a peer can send one small MAX_STREAM_DATA frame naming a very large stream index, and `accept` then yields every stream up to that index. In `quinn`, a loop that keeps calling `accept_bi` can be handed more than 2^40 streams. Depending on the runtime, the endpoint runs out of memory, stops accepting new connections, or keeps busy indefinitely, even after the peer has gone away. Clients and servers that accept peer-initiated bidirectional streams are affected. Unidirectional streams are not.\n\nThe fix validates the stream ID in `received_max_stream_data` and adds a defensive check where streams are opened implicitly. It is in 0.11.19.","affected":[{"package":{"name":"quinn-proto","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"0.11.19"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0523.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/quinn-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0523.html"},{"type":"WEB","url":"https://github.com/quinn-rs/quinn/commit/3eb7465d9e11d7a245e99cde1a4eb872ec26d264"},{"type":"WEB","url":"https://github.com/quinn-rs/quinn/commit/73114d8289d42bd536c790fa00a9beed05a4e5fa"}],"database_specific":{"license":"CC0-1.0"}} |