github-actions[bot] opened a new issue, #3430: URL: https://github.com/apache/iceberg-rust/issues/3430
> Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads | Details | | | ------------------- | ---------------------------------------------- | | Package | `quinn-proto` | | Version | `0.11.16` | | URL | [https://github.com/quinn-rs/quinn/pull/2868](https://github.com/quinn-rs/quinn/pull/2868) | | Date | 2026-09-14 | | Patched versions | `>=0.11.18` | | Unaffected versions | `<0.7.0` | When a stream is read in unordered mode (for example through `RecvStream::read(false)` in quinn-proto or `read_unordered` in `quinn`), quinn-proto proactively deduplicates received data by recording received ranges in a `RangeSet` through its `replace` method. When an incoming STREAM frame carried an empty payload, the `Drop` implementation of the iterator returned by `replace` inserted an empty range into the set, violating the invariant that stored ranges are non-empty. Subsequent frames overlapping that region then caused a panic while processing the stream. A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected. The flaw was corrected in 0.11.18 by ignoring empty ranges in `RangeSet::replace`. Thanks to Otto Hermann ([@ojhermann](https://github.com/ojhermann)) for reporting this issue. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0338.html) for additional details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
