The vulnerability is an unchecked memory consumer caused by an unbounded reassembly of out–of–order QUIC stream fragments in the Quinn library. Under the conditions described, a malicious peer can send many large fragments that cannot be assembled, forcing the Assembler to store each fragment separately and consuming progressively more system memory. Because this is a flaw that can be triggered by traffic received over the network, the primary impact is a denial‑of‑service condition where the target process may exhaust its heap and become unresponsive or crash. The weakness is classified as CWE‑770 (Capacity Exhaustion).

Quinn is a pure‑Rust, async‑compatible implementation of the QUIC transport protocol provided by the quinn‑rs project. Versions from the first release 0.1.0 up through 0.11.14 are affected. These versions are used in any Rust application that depends on the quinn crate to implement QUIC connections. The fix is included in 0.11.15 and later releases.

The CVSS score of 7.5 places the flaw in the high severity range, but the EPSS score of less than 1% indicates that the probability of exploitation is expected to be very low. The vulnerability is not listed in the CISA KEV catalog as of the most recent data. The attack vector is remote over the network, requiring the attacker to establish a QUIC session and send a tailored sequence of fragmented packets that trigger high buffer overhead. While exploit code is not required, any integration that accepts untrusted QUIC traffic is potentially susceptible and can suffer emergent denial of service if resources are saturated.