CVE-2025-24356: UDP traffic amplification via fastd's fast reconnect feature

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-27 · updated 2026-06-17
Weakness: CWE-405

Description

fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to ~90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet (~150 bytes of UDP payload). Including IPv4 and UDP headers, the resulting amplification factor is roughly 12-13. By sending data packets with a spoofed source address to fastd instances reachable on the internet, this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack. This vulnerability is fixed in v23.

Affected products

neocturne fastd: before 23.0 — fixed in 23.0

How to fix

Upgrade to a fixed version: neocturne fastd 23.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-24356 or the next vulnerability affects your stack