CVE-2021-28036: Quinn Project Quinn

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.

Affected products

• Quinn Project Quinn: before 0.5.4 (fixed in 0.5.4); from 0.6.0, before 0.6.2 (fixed in 0.6.2)

Published 2021-03-05. Last modified 2026-06-17.