qcp has possible crash/DOS in some build configurations
Date: 2025-03
Affected: rust/qcp
Attack vector: dos
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-4432
CWE: CWE-770

**Nature of issue:** Crash (Denial of Service) **Source of issue:** Dependent package (ring) **Affected versions of qcp:** 0.1.0-0.3.2 **Recommendation:** Upgrade to qcp 0.3.3 or later ### Who is affected All versions of qcp from 0.1.0 to 0.3.2 are affected, but **only if built with runtime overflow checks.** * Released qcp binaries do not enable runtime overflow checks by default. **If you use an official released qcp binary download, you are not affected.** * If you built qcp yourself in debug mode, you are affected unless your debug configuration explicitly disables overflow checks. * If you built qcp yourself in release mode, you are only affected if you explicitly requested runtime overflow checks at build time by setting the appropriate `RUSTFLAGS`, or in your Cargo.toml profile. ### What to do if you are affected **We recommend you upgrade to qcp 0.3.3 or later.** Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified: * Rebuild locally with runtime overflow checks disabled * Rebuild locally using a fixed version of the `ring` dependency (0.17.12 or later). ### Detail The upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens


Mitigations:

Architectural layers (MAESTRO):