GHSA-hqqc-jr88-p6x2
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hqqc-jr88-p6x2
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-hqqc-jr88-p6x2/GHSA-hqqc-jr88-p6x2.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hqqc-jr88-p6x2
- Aliases
- Published
- 2025-03-31T21:47:20Z
- Modified
- 2025-03-31T22:10:24.710620Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- Netty QUIC hash collision DoS attack
- Details
-
An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).
See https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
- Database specific
{ "nvd_published_at": "2025-03-31T19:15:40Z", "cwe_ids": [ "CWE-407" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-03-31T21:47:20Z" }- References
-
- https://github.com/netty/netty-incubator-codec-quic/security/advisories/GHSA-hqqc-jr88-p6x2
- https://nvd.nist.gov/vuln/detail/CVE-2025-29908
- https://github.com/netty/netty-incubator-codec-quic/commit/e059bd9b78723f8b035e0c547e42ce263f03461c
- https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
- https://github.com/netty/netty-incubator-codec-quic
Affected packages
Maven / io.netty.incubator:netty-incubator-codec-quic
Package
- Name
- io.netty.incubator:netty-incubator-codec-quic
- View open source insights on deps.dev
- Purl
- pkg:maven/io.netty.incubator/netty-incubator-codec-quic