CVE-2025-24946: Medium severity picoquic vulnerability

Published Feb 20, 2025

Updated

The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).

Affected Software

1 affected component

Picoquic picoquic>b80fd3f

Event History

Feb 20, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-24946?

CVE-2025-24946 has been rated as a high severity vulnerability due to its potential for causing a significant CPU load on affected servers.

How do I fix CVE-2025-24946?

To fix CVE-2025-24946, you should upgrade your Picoquic implementation to a version later than b80fd3f.

What impact does CVE-2025-24946 have on my server?

CVE-2025-24946 can lead to a Denial of Service (DoS) condition by consuming excessive CPU resources through hash collisions.

Who is affected by CVE-2025-24946?

CVE-2025-24946 affects users of Picoquic versions prior to b80fd3f.

What mechanism does CVE-2025-24946 exploit?

CVE-2025-24946 exploits a weak hash function in the hash table used for managing connections.