GHSA-hqqc-jr88-p6x2

Source

https://github.com/advisories/GHSA-hqqc-jr88-p6x2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-hqqc-jr88-p6x2/GHSA-hqqc-jr88-p6x2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hqqc-jr88-p6x2

Aliases

CVE-2025-29908

Published

2025-03-31T21:47:20Z

Modified

2025-03-31T22:10:24Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Netty QUIC hash collision DoS attack

Details

An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).

See https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory

Database specific

{
    "cwe_ids":  [
        "CWE-407"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-03-31T21:47:20Z",
    "nvd_published_at":  "2025-03-31T19:15:40Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / io.netty.incubator:netty-incubator-codec-quic

Package

Name: io.netty.incubator:netty-incubator-codec-quic; View open source insights on deps.dev
Purl: pkg:maven/io.netty.incubator/netty-incubator-codec-quic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.71.Final

Affected versions

0.*

0.0.1.Final

0.0.2.Final

0.0.3.Final

0.0.4.Final

0.0.5.Final

0.0.6.Final

0.0.7.Final

0.0.8.Final

0.0.9.Final

0.0.10.Final

0.0.11.Final

0.0.12.Final

0.0.13.Final

0.0.14.Final

0.0.15.Final

0.0.16.Final

0.0.17.Final

0.0.18.Final

0.0.19.Final

0.0.20.Final

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-hqqc-jr88-p6x2/GHSA-hqqc-jr88-p6x2.json"