Summary

The vendored Cargo.lock in the Rust bridge ships quinn-proto 0.11.14, which is affected by **RUSTSEC-2026-0185 ** (Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly).

The fix is quinn-proto >= 0.11.15.

Both temporalio 1.29.0 on PyPI include the vulnerable version.

Steps to reproduce

pip install temporalio==1.29.0
# Inspect the vendored lockfile:
python -c "
import zipfile, sysconfig, pathlib
p = pathlib.Path(sysconfig.get_paths()['purelib']) / 'temporalio' / 'bridge' / 'Cargo.lock'
import re
for m in re.finditer(r'name = \"quinn-proto\"\nversion = \"([^\"]+)\"', p.read_text()):
    print(f'quinn-proto = {m.group(1)}')
"
# Output: quinn-proto = 0.11.14

Expected

quinn-proto >= 0.11.15 in the vendored Cargo.lock.

References

• CVE: https://rustsec.org/advisories/RUSTSEC-2026-0185.html