You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@datafusion.apache.org by "kosiew (via GitHub)" <gi...@apache.org> on 2026/06/24 04:02:06 UTC
[I] Security: Update `quinn-proto` to fix RustSec RUSTSEC-2026-0185 [datafusion]
kosiew opened a new issue, #23141:
URL: https://github.com/apache/datafusion/issues/23141
## Summary
The [security audit](https://github.com/apache/datafusion/actions/runs/28019080794/job/82930549389) is failing because `Cargo.lock` pins `quinn-proto` to `0.11.14`, which is affected by RustSec advisory `RUSTSEC-2026-0185`.
Update `quinn-proto` to `0.11.15` or newer.
## Details
Audit failure:
- Crate: `quinn-proto`
- Current version: `0.11.14`
- Advisory: `RUSTSEC-2026-0185`
- Title: Remote memory exhaustion in `quinn-proto` from unbounded out-of-order stream reassembly
- Severity: High, 7.5
- Fixed version: `>=0.11.15`
The audit also reports `paste 1.0.15` as unmaintained under `RUSTSEC-2024-0436`, but that warning is already allowed and is not the failing vulnerability.
## Proposed fix
Perform a dependency-only lockfile update:
```bash
cargo update -p quinn-proto --precise 0.11.15
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] Security: Update `quinn-proto` to fix RustSec RUSTSEC-2026-0185 [datafusion]
Posted by "Phoenix500526 (via GitHub)" <gi...@apache.org>.
Phoenix500526 commented on issue #23141:
URL: https://github.com/apache/datafusion/issues/23141#issuecomment-4786322281
It has already been resolved in #23122
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] Security: Update `quinn-proto` to fix RustSec RUSTSEC-2026-0185 [datafusion]
Posted by "kosiew (via GitHub)" <gi...@apache.org>.
kosiew commented on issue #23141:
URL: https://github.com/apache/datafusion/issues/23141#issuecomment-4786518763
@Phoenix500526
Thanks for the update
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] Security: Update `quinn-proto` to fix RustSec RUSTSEC-2026-0185 [datafusion]
Posted by "kosiew (via GitHub)" <gi...@apache.org>.
kosiew closed issue #23141: Security: Update `quinn-proto` to fix RustSec RUSTSEC-2026-0185
URL: https://github.com/apache/datafusion/issues/23141
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org