« Volver al listado

CVE-2025-24946

Estado: AplazadaMedia (5.3)—

The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Privateoctopus — PicoquicAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24946",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24946",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-20T17:26:15.046358Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "privateoctopus",
          "product": "picoquic",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "b80fd3f5903279ae3e7714ee4109363d9ab4491a",
              "versionType": "git"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-20T03:15:12.800",
  "references": [
    {
      "url": "https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/private-octopus/picoquic/commit/b80fd3f5903279ae3e7714ee4109363d9ab4491a",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs)."
    },
    {
      "lang": "es",
      "value": "La tabla hash utilizada para administrar las conexiones en Picoquic antes de B80FD3F utiliza una función hash débil, lo que permite a los atacantes remotos causar una carga de CPU considerable en el servidor (un ataque de hash DOS) iniciando conexiones con ID de conexión de origen (SCID)."
    }
  ],
  "lastModified": "2026-06-17T08:59:52.137",
  "sourceIdentifier": "cve@mitre.org"
}