CVE-2025-24947
Quick assessment
Affected
litespeedtech LSQUIC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Litespeed Technologie LiteSpeed QUIC（LSQUIC）是美国Litespeed Technologie公司的一种用于服务器和客户端的 QUIC 和 HTTP/3 功能的开源实现。 Litespeed Technologie LiteSpeed QUIC（LSQUIC） 4.2.0版本之前存在安全漏洞，该漏洞源于存在哈希冲突漏洞。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-24947
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Vulnerability Title
Litespeed Technologie LiteSpeed QUIC（LSQUIC） 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Litespeed Technologie LiteSpeed QUIC（LSQUIC）是美国Litespeed Technologie公司的一种用于服务器和客户端的 QUIC 和 HTTP/3 功能的开源实现。 Litespeed Technologie LiteSpeed QUIC（LSQUIC） 4.2.0版本之前存在安全漏洞，该漏洞源于存在哈希冲突漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| litespeedtech | LSQUIC | 0 ~ 4.2.0 | - |
|
II. Public POCs for CVE-2025-24947
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-24947
请登录查看更多情报信息。
Proof of Concept for CVE-2025-24947 (1)
Vendor Pages for CVE-2025-24947 (1)
Other References for CVE-2025-24947 (1)
IV. Related Vulnerabilities
Same vendor: litespeedtech
-
CVE-2026-115482
lsquic 4.9.0 前 HTTP/3 QPACK 内存放大漏洞 -
CVE-2026-104474
OpenLiteSpeed before 1.9.3 Local Privilege Escalation via ls -
CVE-2026-93903
LiteSpeed Web Server 6.3.7前内部重定向验证漏洞 -
CVE-2026-76579
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via -
CVE-2026-3129
LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cros
Same weakness: CWE-407
-
CVE-2026-115352
Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Bracke -
CVE-2026-115347
Mistune before 3.3.0 Quadratic Denial of Service via parse_l -
CVE-2026-115319
fzf 0.36.0 through 0.74.5 Denial of Service via maskActionCo -
CVE-2026-96643
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic t -
CVE-2026-114143
toml-node: Quadratic-complexity DoS via long dotted keys or
V. Comments for CVE-2025-24947
No comments yet