CVE-2025-24947
Medium
Description
A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.
SeverityMedium
CVSS5.3
Exploit probability—
ProductLSQUIC
PublishedFeb 20, 2025
First seenFeb 20, 2025
Weakness typeCWE-407CWE-407
How to fix
Update
- litespeedtech LSQUIC4.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| litespeedtech LSQUIC | v < 4.2.0 | 4.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.