CVE-2025-24946

MEDIUM Year: 2025
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-407
View all →

Vulnerability Description

The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).

Related Vulnerabilities

CVE-2020-27223

MEDIUM
CVSS:5.3(Medium)

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameter...

CWE-4072020

CVE-2020-3548

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the Transport Layer Security (TLS) protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attack...

CWE-4072020

CVE-2024-12133

MEDIUM
CVSS:5.3(Medium)

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down ...

CWE-4072024

CVE-2024-12243

MEDIUM
CVSS:5.3(Medium)

A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, lead...

CWE-4072024

CVE-2025-23020

MEDIUM
CVSS:5.3(Medium)

An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a H...

CWE-4072025

CVE-2025-24947

MEDIUM
CVSS:5.3(Medium)

A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash...

CWE-4072025