s2n-quic Vulnerability: Excessive Memory Allocation Warning
- Severity
- HIGH
- Affected component
- s2n-quic (cargo)
- Affected versions
- < 1.31.0 or < 1.82.0 or >= 1.22.0, < 1.23.0 or >= 1.22.0, <= 1.22.0 or < 1.25.0
- Patched version
- v1.82.0
An early warning has been issued for a vulnerability in the s2n-quic Rust implementation of the QUIC protocol. Versions <= v1.81.0 are reportedly affected by excessive memory allocation, which may allow an unauthenticated user to cause a denial of service.
What happened
The s2n-quic Rust implementation of the QUIC protocol is under investigation for a vulnerability that involves excessive memory allocation. This vulnerability, if exploited, allows an unauthenticated user to send crafted CRYPTO frames that could lead to a denial of service. The versions affected are those less than or equal to v1.81.0. The vulnerability has been tracked under the ID GHSA-9Q54-F358-3FQF.
The vulnerability was first flagged on 2026-08-14T21:44:19+00:00. It is not yet confirmed to have been exploited in the wild. Software engineers using s2n-quic in their projects should assess their exposure by checking the versions in use against the affected range provided in the threat data.
What to do about it
- Upgrade to s2n-quic version v1.82.0 to mitigate the vulnerability.
- Review your project dependencies to identify any use of s2n-quic and ensure they are updated to the patched version.
- Monitor the primary sources for any updates or further advisories related to this vulnerability.
How 0Day would have caught this
s2n-quic is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if your project uses s2n-quic versions < 1.31.0 or < 1.82.0 or >= 1.22.0, < 1.23.0 or >= 1.22.0, <= 1.22.0 or < 1.25.0.
What should I do right now?
Immediately upgrade to s2n-quic version v1.82.0 to mitigate the vulnerability.
Is there an official fix available?
Yes, the official fix is s2n-quic version v1.82.0.