CVE-2025-29908CWE-407

Netty QUIC hash collision DoS attack

Medium · published March 31, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
46.9
In the wild
Unconfirmed
What it is

Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This vulnerability is fixed in 0.0.71.Final.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00579 · 46.9th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2025-03-31T18:43Z
EPSS history
Timeline
  • 31 MAR 18:43Z
    Netty QUIC hash collision DoS attack
    cvelistv5