What is GHSA-FMWF-C46W-R8QM?

GHSA-FMWF-C46W-R8QM is a medium-severity security vulnerability in qcp (rust), affecting versions < 0.3.3. It is fixed in 0.3.3.

Which versions of qcp are affected by GHSA-FMWF-C46W-R8QM?

qcp (rust) versions < 0.3.3 is affected.

Is there a fix for GHSA-FMWF-C46W-R8QM?

Yes. GHSA-FMWF-C46W-R8QM is fixed in 0.3.3. Upgrade to this version or later.

Is GHSA-FMWF-C46W-R8QM exploitable, and should I be worried?

Whether GHSA-FMWF-C46W-R8QM is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-FMWF-C46W-R8QM is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

GHSA-FMWF-C46W-R8QM in qcp

Q: Which versions of qcp are affected by GHSA-FMWF-C46W-R8QM?

qcp (rust) versions < 0.3.3 is affected.

Q: Is there a fix for GHSA-FMWF-C46W-R8QM?

Yes. GHSA-FMWF-C46W-R8QM is fixed in 0.3.3. Upgrade to this version or later.

Q: Is GHSA-FMWF-C46W-R8QM exploitable, and should I be worried?

Whether GHSA-FMWF-C46W-R8QM is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-FMWF-C46W-R8QM is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Summary

qcp has possible crash/DOS in some build configurations

Nature of issue: Crash (Denial of Service)
Source of issue: Dependent package (ring)
Affected versions of qcp: 0.1.0-0.3.2
Recommendation: Upgrade to qcp 0.3.3 or later

Who is affected

All versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.

Released qcp binaries do not enable runtime overflow checks by default. If you use an official released qcp binary download, you are not affected.
If you built qcp yourself in debug mode, you are affected unless your debug configuration explicitly disables overflow checks.
If you built qcp yourself in release mode, you are only affected if you explicitly requested runtime overflow checks at build time by setting the appropriate RUSTFLAGS, or in your Cargo.toml profile.

What to do if you are affected

We recommend you upgrade to qcp 0.3.3 or later.
Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully.

Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:

Rebuild locally with runtime overflow checks disabled
Rebuild locally using a fixed version of the ring dependency (0.17.12 or later).

Detail

The upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received.

The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue.

Additional notes

The qcp protocol itself does not rely on runtime overflow checks for its security.
While QUIC servers are normally public-facing, qcp is a hybrid protocol that first requires an authenticated ssh session in order to set up the QUIC session. The window of attackability is therefore reduced, though will depend on your usage profile.
An additional layer of obscurity is provided by qcp using ephemeral, random port numbers for its QUIC traffic (subject to user configuration).

References

Upstream advisories:

Impact

During qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.

In that case, and only if qcp was built with runtime overflow checks enabled, the effect is a Rust panic which immediately aborts the transfer. There is no additional impact on system resources at either end, nor on other file transfers in progress.
As qcp runs a separate process for every connected user, the impact of the attack is limited to a single session.

The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled.

As of the time of writing, we are not aware of any reports of this issue being exploited.

Affected versions

qcp (< 0.3.3)

Security releases

qcp → 0.3.3 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade qcp to 0.3.3 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is GHSA-FMWF-C46W-R8QM? GHSA-FMWF-C46W-R8QM is a medium-severity security vulnerability in qcp (rust), affecting versions < 0.3.3. It is fixed in 0.3.3.
Which versions of qcp are affected by GHSA-FMWF-C46W-R8QM? qcp (rust) versions < 0.3.3 is affected.
Is there a fix for GHSA-FMWF-C46W-R8QM? Yes. GHSA-FMWF-C46W-R8QM is fixed in 0.3.3. Upgrade to this version or later.
Is GHSA-FMWF-C46W-R8QM exploitable, and should I be worried? Whether GHSA-FMWF-C46W-R8QM is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-FMWF-C46W-R8QM is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-FMWF-C46W-R8QM? Upgrade qcp to 0.3.3 or later.