CVE-2025-24947 MEDIUM

CVE-2025-24947

Vendor Litespeedtech

Product LSQUIC

Weakness CWE-407

Published February 20, 2025

Last update February 20, 2025

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.

Key dates

02Disclosure timeline

February 20, 2025 CVE published

February 20, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-24947 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/407.html

Related vulnerabilities

04Related CVE

CVE-2024-12243 Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos CVE-2026-28804 pypdf: Inefficient decoding of ASCIIHexDecode streams CVE-2026-3276 Potential DoS via quadratic complexity in unicodedata.normalize() CVE-2024-43483 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2023-46136 Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning