CVE-2025-24947

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-20 · updated 2026-06-17
Weakness: CWE-407

Description

A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.

Affected products

litespeedtech LSQUIC: before 4.2.0 — fixed in 4.2.0

How to fix

Upgrade to a fixed version: litespeedtech LSQUIC 4.2.0. Check the vendor advisory for mitigations.

References

https://github.com/litespeedtech/lsquic/releases/tag/v4.2.0
https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
https://xxhash.com

Get alerted when CVE-2025-24947 or the next vulnerability affects your stack