Back to Database
Status published
Medium
CVE-2025-24947
A hash collision vulnerability (in the hash table used to...
Vulnerability Description
A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24947
Credits & Attribution
No credits recorded in the NVD database.
References
More from litespeedtech
View All →CVE-2025-54939
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory...
Medium
5.3
CVE-2025-12450
LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting
Medium
6.1
CVE-2024-9169
litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
5.5
CVE-2024-3246
LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
6.1
CVE-2023-4372
LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
6.4
Affected Vendor
litespeedtech
View all reports →Affected Software
LSQUIC
Vulnerable Versions:
0
Timeline
Official Publish:
February 20th, 2025
Last Modified:
February 20th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.