CVE-2025-24946

MEDIUM

picoquic < b80fd3f5903279ae3e7714ee4109363d9ab4491a - Denial of Service via Hash Table Collision

Title source: llm

Description

The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).

References (2)

Core 2

Core References

Various Sources

https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory

View Writeup ZIP pw:eip

Patch

https://github.com/private-octopus/picoquic/commit/b80fd3f5903279ae3e7714ee4109363d9ab4491a

View Patch ZIP pw:eip

Scores

CVSS v3 5.3

EPSS 0.0051

EPSS Percentile 39.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-407

Status published

Products (1)

privateoctopus/picoquic < b80fd3f5903279ae3e7714ee4109363d9ab4491a

Published Feb 20, 2025

Tracked Since Feb 18, 2026