Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2fc36ddefe advisory.

    Fix CVE-2026-31812: Bump tar-rs to .5.45 - Closes rhbz#2449672

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20569-1 advisory.

    Changes in rust1.94:

    - Don't force gcc-15 on SLE-16 and higher (bsc#1261876)

    Update to rust1.94.1:

    - Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.1

    - Avoid unwrapping varint decoding during parameters parsing       (bsc#1259623 CVE-2026-31812).

    - Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1415-1 advisory.

    Security issue:

    - CVE-2026-31812: denial of service via crafted QUIC initial packet (bsc#1259623).

    Non security issue:

    - Resolve missing gcc requirement that may affect some crate buildin (bsc#1253321).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1337-1 advisory.

    - CVE-2026-31812: Denial of service via crafted QUIC initial packet (bsc#1259623).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d62d7fe77e advisory.

    Fix CVE-2026-31812: Bump tar-rs to .5.45 - Closes rhbz#2449672

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2026:1001-1 advisory.

    This update adds rust1.94.

    Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0

    - CVE-2026-31812:  avoid unwrapping varint decoding during parameters parsing (bsc#1259623)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ae0b7bdc90 advisory.

    Automatic update for bpfman-0.5.4-7.fc45.

    ##### **Changelog**

    ```
    * Sun Mar 22 2026 Daniel Mellado <dmellado@fedoraproject.org> - 0.5.4-7
    - Fix CVE-2026-31812: Bump tar-rs to .5.45 - Closes rhbz#2449672

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2fef29d32a advisory.

    Fix CVE-2026-31812: Bump quinn-proto to 0.11.14 - Closes rhbz#2446359

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0523662d59 advisory.

    Automatic update for bpfman-0.5.4-6.fc45.

    ##### **Changelog**

    ```
    * Wed Mar 11 2026 Daniel Mellado <dmellado@fedoraproject.org> - 0.5.4-6
    - Fix CVE-2026-31812: Bump quinn-proto to 0.11.14 - Closes rhbz#2446359

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to     0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using     vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed     quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with     unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network     with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.
    (CVE-2026-31812)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310875	Fedora 44 : bpfman (2026-2fc36ddefe)	Nessus	Fedora Local Security Checks	high
309137	openSUSE 16 Security Update : rust1.94 (openSUSE-SU-2026:20569-1)	Nessus	SuSE Local Security Checks	high
306869	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rust1.93 (SUSE-SU-2026:1415-1)	Nessus	SuSE Local Security Checks	high
306690	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rust1.92 (SUSE-SU-2026:1337-1)	Nessus	SuSE Local Security Checks	high
304653	Fedora 43 : bpfman (2026-d62d7fe77e)	Nessus	Fedora Local Security Checks	high
303778	SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for rust1.94 (SUSE-SU-SUSE-RU-2026:1001-1)	Nessus	SuSE Local Security Checks	high
303297	Fedora 45 : bpfman (2026-ae0b7bdc90)	Nessus	Fedora Local Security Checks	high
303118	Fedora 43 : bpfman (2026-2fef29d32a)	Nessus	Fedora Local Security Checks	high
301892	Fedora 45 : bpfman (2026-0523662d59)	Nessus	Fedora Local Security Checks	high
301791	Linux Distros Unpatched Vulnerability : CVE-2026-31812	Nessus	Misc.	high

Detections

Analytics

CVE-2026-31812

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high