This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate quinn

Dependencies

(12 total, 4 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 async-io^1.62.3.2out of date
 async-std^1.111.12.0up to date
 bytes^11.6.0up to date
 futures-io^0.3.190.3.30up to date
 pin-project-lite^0.20.2.14up to date
 quinn-proto ⚠️^0.10.20.11.2out of date
 rustc-hash^1.11.1.0up to date
 rustls ⚠️^0.21.00.23.8out of date
 thiserror^1.0.211.0.61up to date
 tokio^1.28.11.37.0up to date
 tracing^0.1.100.1.40up to date
 quinn-udp^0.40.5.1out of date

Dev dependencies

(12 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.221.0.86up to date
 bencher^0.1.50.1.5up to date
 clap^44.5.4up to date
 crc^33.2.1up to date
 directories-next^22.0.0up to date
 rand^0.80.8.5up to date
 rcgen^0.10.00.13.1out of date
 rustls-pemfile^1.0.02.1.2out of date
 tokio^1.28.11.37.0up to date
 tracing-futures^0.2.00.2.5up to date
 tracing-subscriber^0.3.00.3.18up to date
 url^22.5.0up to date

Security Vulnerabilities

quinn-proto: Denial of service in Quinn servers

RUSTSEC-2023-0063

Receiving QUIC frames containing a frame with unknown frame type could lead to a panic. Unfortunately this is issue was not found by our fuzzing infrastructure.

Thanks to the QUIC Tester research group for reporting this issue.

rustls: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

RUSTSEC-2024-0336

If a close_notify alert is received during a handshake, complete_io does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io and are not affected.

rustls::Stream and rustls::StreamOwned types use complete_io and are affected.