This might be a false positive, but src-tauri/Cargo.lock around line 3238 looked worth a second pair of eyes.
Quinn‑proto uses unwrap() to decode attacker‑controlled varints in QUIC transport parameters. A malformed Initial packet with a truncated varint causes decode to return Err(UnexpectedEnd), which unwrap() then panics, aborting the process. An unauthenticated remote attacker can trigger this denial‑of‑service with a single packet, leading to complete service outage.
Something like this might fix it:
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -5,7 +5,7 @@ [dependencies]
[dependencies]
-quinn-proto = "0.11.13"
+quinn-proto = "0.11.14"
For reference: rule CVE-2026-31812. Rated high.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
src-tauri/Cargo.lockaround line 3238 looked worth a second pair of eyes.Quinn‑proto uses unwrap() to decode attacker‑controlled varints in QUIC transport parameters. A malformed Initial packet with a truncated varint causes decode to return Err(UnexpectedEnd), which unwrap() then panics, aborting the process. An unauthenticated remote attacker can trigger this denial‑of‑service with a single packet, leading to complete service outage.
Something like this might fix it:
For reference: rule
CVE-2026-31812. Rated high.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.