CVE-2025-24947

State: Published
Severity: 5.3 Medium
Published: Feb 20, 2025
Updated: Feb 20, 2025
Reserved: Jan 29, 2025

Description

A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	mitre

Weaknesses

CWE-407 Inefficient Algorithmic Complexity

Affected Products

Product	Versions
LSQUIClitespeedtech	before 4.2.0Affected

References

https://xxhash.com/
https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
https://github.com/litespeedtech/lsquic/releases/tag/v4.2.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.