CVE-2025-29908: Netty QUIC hash collision DoS attack
An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).
See https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
Other sources
Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This vulnerability is fixed in 0.0.71.Final.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-29908?
CVE-2025-29908 has a high severity rating due to its potential to trigger a Hash DoS attack on the server.
How do I fix CVE-2025-29908?
To mitigate CVE-2025-29908, upgrade to version 0.0.71.Final of the netty-incubator-codec-quic package or later, or ensure that IBM Guardium Data Protection is updated to version 12.1 or higher.
Which systems are affected by CVE-2025-29908?
CVE-2025-29908 affects the io.netty.incubator:netty-incubator-codec-quic package and IBM Guardium Data Protection versions up to and including 12.1.
What is a Hash DoS attack in the context of CVE-2025-29908?
A Hash DoS attack related to CVE-2025-29908 exploits hash collisions to overload server CPU usage by initiating multiple connections with colliding Source Connection IDs.
Is there a known exploit for CVE-2025-29908?
As of now, there are no publicly disclosed exploits specific to CVE-2025-29908, but the vulnerability poses significant risk and should be addressed promptly.