An issue was discovered in the quinn crate before 0.7.0 for Rust.
Priority LOW 35CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
Why it matters now
EPSS 0.01261 69th percentileScored 2026-11-07
Fix Fixed quinn (crates.io): 0.5.4, 0.6.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | quinn (crates.io) | before 0.5.4 | 0.5.4 | Patch available | GHSA-fhv4-fx3v-77w6 |
| — | quinn (crates.io) | 0.6.0 to before 0.6.2 | 0.6.2 | Patch available | GHSA-fhv4-fx3v-77w6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- quinn (crates.io) Vendor— Affected before 0.5.4 Fixed in 0.5.4 Patch available GHSA-fhv4-fx3v-77w6
- quinn (crates.io) Vendor— Affected 0.6.0 to before 0.6.2 Fixed in 0.6.2 Patch available GHSA-fhv4-fx3v-77w6
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:quinn_project:quinn:*:*:*:*:*:rust:*:* | before 0.5.4; 0.6.0 to before 0.6.2 | Vulnerable | Quinn Project |
- cpe:2.3:a:quinn_project:quinn:*:*:*:*:*:rust:*:* Versions before 0.5.4; 0.6.0 to before 0.6.2 Vulnerable ·Quinn Project
Remediation
- Fix · GHSA-fhv4-fx3v-77w6 quinn (crates.io) Fixed in 0.5.4 Advisory →
- Fix · GHSA-fhv4-fx3v-77w6 quinn (crates.io) Fixed in 0.6.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28036
- 2026-10-03 Alias added: GHSA-fhv4-fx3v-77w6
References
More Quinn Project Quinn vulnerabilities
- TI-2024-30382 Denial of service in quinn-proto when using `Endpoint::retry()` CVSS 3.1HIGH 7.5
- TI-2023-22896 quinn-proto Denial of Service vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2021-28036 · CVE Program
- CVE-2021-28036 · NVD
- FIRST EPSS
- GHSA-fhv4-fx3v-77w6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences