Three more security issues were reported and fixed since 0.11.17:

• https://github.com/quinn-rs/quinn/security/advisories/GHSA-465w-v9q3-7j98: a remote peer can panic unordered reads from quinn-proto with five small STREAM frames
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-ppcp-v39w-8jq2: Datagrams::send() double-subtracts payload_bytes on the drop-oldest path, panicking the sender
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-3g6h-r5qx-f6hq: Peer minimum ACK delay can panic when ACK_FREQUENCY transmission is enabled

• 0.11.x: backport the black hole detector fixes by @vcarus in https://github.com/quinn-rs/quinn/pull/2799
• 0.11.x: fix payload_bytes double subtraction when evicting outgoing datagrams by @vcarus in https://github.com/quinn-rs/quinn/pull/2806
• 0.11.x: Backport #2816 (add min rtt to path stats) by @somtochiama in https://github.com/quinn-rs/quinn/pull/2817
• 0.11.x: Bundle ACK in packets with DATAGRAM or STREAM frames by @anatawa12 in https://github.com/quinn-rs/quinn/pull/2819
• quinn-proto: drop short packets with unsupported versions (0.11.x) by @vcarus in https://github.com/quinn-rs/quinn/pull/2823
• 0.11.x: backport: Avoid re-instantiating debug span in ConnectionDriver::poll by @stormshield-fabs in https://github.com/quinn-rs/quinn/pull/2829
• 0.11.x: backport #2814 (proto: coalesce contiguous chunks during defragment) by @Ralith in https://github.com/quinn-rs/quinn/pull/2826
• [0.11.x] proto: release the send window when rejecting 0-RTT by @zerox80 in https://github.com/quinn-rs/quinn/pull/2843
• [0.11.x] Reject DATAGRAMs larger than the send buffer by @zerox80 in https://github.com/quinn-rs/quinn/pull/2844
• 0.11.x: backport #2847 (proto: send DATA_BLOCKED and STREAM_DATA_BLOCKED when blocked by flow control) by @heitzlki in https://github.com/quinn-rs/quinn/pull/2852
• [0.11.x] proto: reset pacing state when resetting a path by @zerox80 in https://github.com/quinn-rs/quinn/pull/2850
• [0.11.x] proto: avoid duplicate flow-control credit for stopped streams by @zerox80 in https://github.com/quinn-rs/quinn/pull/2848
• [0.11.x] proto: prune queued DATAGRAMs after path MTU changes by @zerox80 in https://github.com/quinn-rs/quinn/pull/2849
• [0.11.x] proto: preserve the server config for pending incoming connections by @zerox80 in https://github.com/quinn-rs/quinn/pull/2865
• [0.11.x] proto: reject transport parameters with a mismatched length by @MaxFreedomPollard in https://github.com/quinn-rs/quinn/pull/2866
• [0.11.x] quinn: enforce read_to_end limits for reordered chunks by @zerox80 in https://github.com/quinn-rs/quinn/pull/2864
• [0.11.x] streams: bound retained send storage by the send window by @zerox80 in https://github.com/quinn-rs/quinn/pull/2863
• Prepare 0.11.18 by @djc in https://github.com/quinn-rs/quinn/pull/2867

• fix: Patches for Redox targets by @willnode in https://github.com/quinn-rs/quinn/pull/2659
• feat(udp): add support for IP_RECVERR and IPV6_RECVERR (Linux/Android) by @syszery in https://github.com/quinn-rs/quinn/pull/2646
• feat: implement kernel receive timestamps on Linux/Android by @syszery in https://github.com/quinn-rs/quinn/pull/2634
• quinn-udp: handle EIO from sendmsg in the cmsg fallback (not just EINVAL) by @SkeletonGamer in https://github.com/quinn-rs/quinn/pull/2719
• fix(quinn-udp): avoid permanent EWOULDBLOCK from macOS sendmsg bug by @larseggert in https://github.com/quinn-rs/quinn/pull/2727
• Ignore EMSGSIZE error triggered by ICMP Frag Needed (Path To Big) by @zoltanszatmary in https://github.com/quinn-rs/quinn/pull/2736
• Fix quinn-udp compile errors and assertions on musl by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2750
• chore(udp): deprecate UdpSocketState::send by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2779
• Add GNU/Hurd support by @sthibaul in https://github.com/quinn-rs/quinn/pull/2807
• feat(udp): make transport error reception opt-in on Linux/Android by @syszery in https://github.com/quinn-rs/quinn/pull/2765
• quinn-udp: support wasm32-wasip2 and remove the fallback backend by @temporaryfix in https://github.com/quinn-rs/quinn/pull/2755
• fix(windows): disable USO after probing for GSO support by @shitz in https://github.com/quinn-rs/quinn/pull/2824
• fix(udp): don't panic in UdpSocketState::new on unbound socket by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2821
• fix: resolve WSARecvMsg per socket by @larseggert in https://github.com/quinn-rs/quinn/pull/2825

Note that the minimum supported Rust version rose from 1.80.0 to 1.88.0 in this release, via https://github.com/quinn-rs/quinn/pull/2599, https://github.com/quinn-rs/quinn/pull/2602 and https://github.com/quinn-rs/quinn/pull/2669.

• @willnode made their first contribution in https://github.com/quinn-rs/quinn/pull/2659
• @SkeletonGamer made their first contribution in https://github.com/quinn-rs/quinn/pull/2719
• @sthibaul made their first contribution in https://github.com/quinn-rs/quinn/pull/2807
• @temporaryfix made their first contribution in https://github.com/quinn-rs/quinn/pull/2755
• @shitz made their first contribution in https://github.com/quinn-rs/quinn/pull/2824

Full Changelog: https://github.com/quinn-rs/quinn/compare/quinn-udp-0.6.1...quinn-udp-0.6.2

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and https://github.com/quinn-rs/quinn/pull/2789 for the fixes.

• fix(ci): fix clippy lints by @LesnyRumcajs in https://github.com/quinn-rs/quinn/pull/2752
• congestion: saturate CUBIC window increment to avoid overflow by @LesnyRumcajs in https://github.com/quinn-rs/quinn/pull/2751
• 0.11.x: Backport memory use fixes and prepare release by @Ralith in https://github.com/quinn-rs/quinn/pull/2790

Full Changelog: https://github.com/quinn-rs/quinn/compare/quinn-proto-0.11.16...quinn-proto-0.11.17

• 0.11.x: upgrade dependencies by @djc in https://github.com/quinn-rs/quinn/pull/2707

• quinn-udp: allow to use windows-sys 0.61 in 0.11.x branch by @zh-jq in https://github.com/quinn-rs/quinn/pull/2689
• 0.11.x: upgrade dependencies by @djc in https://github.com/quinn-rs/quinn/pull/2707

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

• Prepare 0.11.x branch for release by @djc in https://github.com/quinn-rs/quinn/pull/2645
• Backport of #2495 to 0.11.x by @stablebits in https://github.com/quinn-rs/quinn/pull/2674
• 0.11.x backport | quinn-proto: drop Initials silently when saturated by @stablebits in https://github.com/quinn-rs/quinn/pull/2688
• Backport #2677 to 0.11.x by @syszery in https://github.com/quinn-rs/quinn/pull/2690
• congestion: avoid double-reducing CUBIC fast convergence (0.11.x) by @0xdeafbeef in https://github.com/quinn-rs/quinn/pull/2641
• proto: yield error on too many gaps in assembler by @djc in https://github.com/quinn-rs/quinn/pull/2694

• fix: reuse existing socket for probing GRO/GSO support by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2565
• refactor(quinn-udp): add retry_if_interrupted helper by @larseggert in https://github.com/quinn-rs/quinn/pull/2583
• fix(unix): disable GSO after probing by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2584
• fix: Resolve sendmsg_x/recvmsg_x via dlsym by @larseggert in https://github.com/quinn-rs/quinn/pull/2571
• chore: bump quinn-udp to 0.6.1 by @larseggert in https://github.com/quinn-rs/quinn/pull/2586

• 41bf1db6 fix: evaluate max_gso_segments for every socket on Windows
• a0ec97a5 feat(quinn-udp): make Apple fast datapath opt-in
• e5b30f51 quinn-udp: make ECN best-effort on Windows (Wine/Proton)
• ab9da171 fix(windows): use effective_segment_size
• 8bf6825d Fix quinn-udp on DragonFly BSD
• c1c56861 fix(udp/unix): don't panic on unknown address family
• 74680528 feat!(udp): mark RecvMeta as non_exhaustive
• 3e302f72 Upgrade windows-sys to 0.61
• c8970cf7 Add interface_index to RecvMeta
• 377af288 refactor!: rename log feature to tracing-log

Full Changelog: https://github.com/quinn-rs/quinn/compare/quinn-udp-0.5.14...quinn-udp-0.6.0

@jxs reported a denial of service issue in quinn-proto 5 days ago:

• https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

• Fix over-permissive proto dependency edge by @Ralith in https://github.com/quinn-rs/quinn/pull/2385
• 0.11.x: avoid unwrapping VarInt decoding during parameter parsing by @djc in https://github.com/quinn-rs/quinn/pull/2559

• quinn: Remove explicit write future structs by @gretchenfrage in https://github.com/quinn-rs/quinn/pull/2226
• proto: Make BytesSource private by @gretchenfrage in https://github.com/quinn-rs/quinn/pull/2233
• feat: Make the future returned by SendStream::stopped static by @Frando in https://github.com/quinn-rs/quinn/pull/2220
• refactor(quinn): Remove some usage of execute_poll by @gretchenfrage in https://github.com/quinn-rs/quinn/pull/2232
• Fix false positive GSO detection by @inetic in https://github.com/quinn-rs/quinn/pull/2248
• expose Connection::side() in quinn by @abonander in https://github.com/quinn-rs/quinn/pull/2261
• refactor(quinn): Configure out async_io::UdpSocket when unused by @matheus23 in https://github.com/quinn-rs/quinn/pull/2264
• proto: upgrade to rustls-platform-verifier 0.6 by @djc in https://github.com/quinn-rs/quinn/pull/2276
• Don't violate client CID limits when advertising a preferred address by @Ralith in https://github.com/quinn-rs/quinn/pull/2282
• Various enhancement to quinn perf by @stormshield-damiend in https://github.com/quinn-rs/quinn/pull/2279
• Updated quinn::Connection::send_datagram() docs by @gry8t in https://github.com/quinn-rs/quinn/pull/2284
• Collect qlog recovery metrics by @stormshield-fabs in https://github.com/quinn-rs/quinn/pull/2278
• proto: Add option to pad all application data packets to MTU by @FlorianUekermann in https://github.com/quinn-rs/quinn/pull/2274
• Update to socket2 v0.6 by @Thomasdezeeuw in https://github.com/quinn-rs/quinn/pull/2291
• Upgrade to fastbloom 0.12 by @djc in https://github.com/quinn-rs/quinn/pull/2290
• Fix flaky key update test by @Ralith in https://github.com/quinn-rs/quinn/pull/2292
• chore(Cargo.toml): support both socket2 v0.5 and v0.6 by @mxinden in https://github.com/quinn-rs/quinn/pull/2294
• Tiny clean up of a comment that was in the wrong place by @flub in https://github.com/quinn-rs/quinn/pull/2306
• Do not track lost_packets twice by @flub in https://github.com/quinn-rs/quinn/pull/2308
• proto: fix NewConnectionId size bound by @djc in https://github.com/quinn-rs/quinn/pull/2311
• Configure qlog in TransportConfig by @Ralith in https://github.com/quinn-rs/quinn/pull/2305
• Wake endpoint driver on rebind by @Ralith in https://github.com/quinn-rs/quinn/pull/2325
• Check for in-flight data on-demand by @Ralith in https://github.com/quinn-rs/quinn/pull/2326
• Fix in-flight byte count underflow by @Ralith in https://github.com/quinn-rs/quinn/pull/2319
• build(deps): bump criterion from 0.6.0 to 0.7.0 by @dependabot[bot] in https://github.com/quinn-rs/quinn/pull/2330
• build(deps): bump windows-sys from 0.59.0 to 0.60.2 by @dependabot[bot] in https://github.com/quinn-rs/quinn/pull/2332
• docs(quinn): Revise SendStream::write docs by @gretchenfrage in https://github.com/quinn-rs/quinn/pull/2227
• Improve quinn::ConnectionStats docs by @gry8t in https://github.com/quinn-rs/quinn/pull/2340
• Various enhancement for perf binaries by @stormshield-damiend in https://github.com/quinn-rs/quinn/pull/2342
• Perf/Bench enhancement by @stormshield-damiend in https://github.com/quinn-rs/quinn/pull/2352
• feat: add Connection::set_send_window() by @abonander in https://github.com/quinn-rs/quinn/pull/2268
• perf: add max udp payload size option by @Dreamacro in https://github.com/quinn-rs/quinn/pull/2343
• perf: move client and server on one binary by @Dreamacro in https://github.com/quinn-rs/quinn/pull/2354
• perf: rename perf binary to quinn-perf to prevent name clash with linux perf by @stormshield-damiend in https://github.com/quinn-rs/quinn/pull/2360
• Ignore async-std advisory for now by @djc in https://github.com/quinn-rs/quinn/pull/2362
• Upgrade to fastbloom 0.14 by @djc in https://github.com/quinn-rs/quinn/pull/2363
• Catch EOPNOTSUPP for opportunistic socket flags by @gongy in https://github.com/quinn-rs/quinn/pull/2273