1 line
2.2 KiB
JSON
1 line
2.2 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0538","published":"2026-09-30T12:00:00Z","modified":"2026-11-13T12:45:08.844283231Z","aliases":["GHSA-6pp4-4cxf-xf88"],"summary":"Receive loop can spin after a truncated datagram","details":"Some targets read one datagram per `recvmsg` call instead of using `recvmmsg`: Apple platforms without the `fast-apple-datapath` feature, OpenBSD, NetBSD, Solaris and illumos, and from 0.6 also DragonFly BSD, Redox and GNU/Hurd. On these targets the receive loop set up its `msghdr` only once and looked at the `MSG_TRUNC` flag before checking whether `recvmsg` had failed. After a datagram larger than the receive buffer was dropped, a following `EAGAIN` still saw the old truncation flag. The loop then kept issuing non-blocking receives instead of returning `WouldBlock`.\n\nWhen the receive buffer is smaller than a datagram that arrives, a remote sender can keep the task that drives the socket busy, before any QUIC packet authentication. The loop ends only when a later datagram fits in the buffer. Whether an application is exposed therefore depends on the receive buffer size it uses. Linux, Android, FreeBSD and Windows use other receive paths and are not affected.\n\nThe fix rebuilds the header before every `recvmsg` call and returns receive errors before checking the truncation flag. It is in 0.5.16 and 0.6.3.","affected":[{"package":{"name":"quinn-udp","ecosystem":"crates.io","purl":"pkg:cargo/quinn-udp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.5.16"},{"introduced":"0.6.0"},{"fixed":"0.6.3"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0538.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/quinn-udp"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0538.html"},{"type":"WEB","url":"https://github.com/quinn-rs/quinn/commit/462865a6c33039c26076f7077c7cd7e2f997b9cd"},{"type":"WEB","url":"https://github.com/quinn-rs/quinn/commit/6862d3dcc9a9333fc4160481b3e5e5d154d4dd36"}],"database_specific":{"license":"CC0-1.0"}} |