Advisories for Cargo/Quinn-Proto package

2024

Denial of service in quinn-proto when using `Endpoint::retry()`

As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations: Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop …

2023