CVE-2025-29908— Netty QUIC hash collision DoS attack
Quick assessment
Affected
netty netty-incubator-codec-quic
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Netty QUIC codec是Netty开源的一个新实验性 QUIC 编解码器。 Netty QUIC codec 0.0.71.Final之前版本存在安全漏洞，该漏洞源于哈希碰撞漏洞，可能导致服务器CPU负载过高。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-29908
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netty QUIC hash collision DoS attack
Source: CVE Program / CVE List V5
Vulnerability Description
Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This vulnerability is fixed in 0.0.71.Final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Vulnerability Title
Netty QUIC codec 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Netty QUIC codec是Netty开源的一个新实验性 QUIC 编解码器。 Netty QUIC codec 0.0.71.Final之前版本存在安全漏洞，该漏洞源于哈希碰撞漏洞，可能导致服务器CPU负载过高。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| netty | netty-incubator-codec-quic | < 0.0.71.Final | - |
|
II. Public POCs for CVE-2025-29908
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-29908
请登录查看更多情报信息。
Proof of Concept for CVE-2025-29908 (1)
-
GitHub - ncc-pbottine/QUIC-Hash-Dos-Advisory x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: netty
-
CVE-2026-54251
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direc -
CVE-2026-89044
Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final t -
CVE-2026-76816
Netty: MQTT Topic Name and Client ID Validation Bypass -
CVE-2026-62380
Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection -
CVE-2026-62243
Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
Same weakness: CWE-407
-
CVE-2026-71418
Suricata doh2: crafted HTTP/2 DATA frames can cause quadrati -
CVE-2026-63447
Suricata ftp: crafted FTP traffic can cause quadratic CPU co -
CVE-2026-69184
c-ares: CPU-exhaustion denial of service via unbounded DNS n -
CVE-2026-44639
NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing -
CVE-2026-92987
roxmltree through 0.21.1 Denial of Service via Quadratic Par
V. Comments for CVE-2025-29908
No comments yet