ByteOS Network

NVD Vulnerability Details :

CVE-2025-24947

Received

Source-cve@mitre.org

Published At-20 Feb, 2025 | 03:15

Updated At-20 Feb, 2025 | 03:15

A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE ID	Type	Source
CWE-407	Secondary	cve@mitre.org

References

Hyperlink	Source	Resource
https://github.com/litespeedtech/lsquic/releases/tag/v4.2.0	cve@mitre.org	N/A
https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory	cve@mitre.org	N/A
https://xxhash.com	cve@mitre.org	N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History