CVE-2024-45311 – Denial of service in quinn-proto when using `Endpoint::retry()`

https://notcve.org/view.php?id=CVE-2024-45311

02 Sep 2024 — Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `retry()`, `refuse()`, or `ignore()` an `Incoming` connection. However, calling `retry()` on an unvalidated connection exposes the server to a likely panic in the following situations: 1. Calling `refuse` or `ignore` on the resulting validated connection, if a duplicate initial packet is received. This issue can go undetected until a server's `refuse()... • https://github.com/quinn-rs/quinn/security/advisories/GHSA-vr26-jcq5-fjj8 • CWE-670: Always-Incorrect Control Flow Implementation •