Uncaught Exception Affecting rust1.92 package, versions <1.92.0-150300.7.6.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.18% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Uncaught Exception vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-SLES157-RUST192-16092004
  • published16 Apr 2026
  • disclosed15 Apr 2026

Introduced: 15 Apr 2026

NewCVE-2026-31812  (opens in a new tab)
CWE-248  (opens in a new tab)

How to fix?

Upgrade SLES:15.7 rust1.92 to version 1.92.0-150300.7.6.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust1.92 package and not the rust1.92 package as distributed by SLES. See How to fix? for SLES:15.7 relevant fixed versions and status.

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.

CVSS Base Scores

version 3.1