Affected: quinn-rs quinn, Red Hat Logging Subsystem for Red Hat OpenShift 6.4, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat Trusted Artifact Signer 1.3, Red Hat Confidential Compute Attestation, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 6 more

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.

Affected: crates.io: quinn-proto

### Summary A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable `quinn` versions by sending a crafted QUIC Initial packet containing malformed `quic_transport_parameters`. `In quinn-proto` parsing logic, attacker-controlled varints are decoded with `unwrap()`, so truncated encodings cause `Err(UnexpectedEnd)` and `panic`. This is reachable over the network with a single packet and no prior trust or authentication.

### Details The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In `quinn-proto` (observed in `quinn-proto 0.11.13`), parsing of some transport parameters uses a fallible varint decode followed by `unwrap()`. For malformed/truncated parameter values, decode returns `UnexpectedEnd`, and `unwrap()` panics.

#### Observed output: ``` thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67: called `Result::unwrap()` on an `Err` value: UnexpectedEnd ```

### PoC #### Reproduces against the upstream Quinn server example. 1. Start server: ``` cargo run --example server -- ./ ``` 2. Prepare PoC client environment: ``` python3 -m venv .venv source .venv/bin/activate pip install aioquic ``` 3. Run PoC script [attack.py](https://github.com/user-attachments/files/25741713/attack.py) against server QUIC listener (default example target shown): ``` python attack.py ``` #### Observed output ``` thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_param…