CVE-2025-24947

5.3 mediumEPSS 0.7%

Medium (5.3). EPSS 0.7% chance of exploitation in the next 30 days.

A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-407
Published: 2025-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/litespeedtech/lsquic/releases/tag/v4.2.0
https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
https://xxhash.com

Check your stack JSON