Affected: quinn-rs quinn, Red Hat Logging Subsystem for Red Hat OpenShift 6.4, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat Trusted Artifact Signer 1.3, Red Hat Confidential Compute Attestation, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 6 more

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.