CVE-2025-29908 Netty QUIC hash collision DoS attack
Remote attackers can cause excessive CPU load on servers using the Netty QUIC codec by initiating connections with colliding Source Connection IDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-29908?
CVE-2025-29908 is a medium-severity denial of service vulnerability in netty-incubator-codec-quic, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This vulnerability is fixed in 0.0.71.Final.
Weakness: CWE-407
Which versions are affected by CVE-2025-29908?
2 open source packages ship an affected version, including io.netty.incubator:netty-incubator-codec-quic.
| Package | Affected | Fixed in |
|---|---|---|
io.netty.incubator:netty-incubator-codec-quic Maven | All versions | 0.0.71.Final |
io.netty.incubator:netty-incubator-codec-quic Maven | All versions | 0.0.71.Final |
How do I fix CVE-2025-29908?
Upgrade io.netty.incubator:netty-incubator-codec-quic to 0.0.71.Final or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-29908 being exploited?
There is no known exploitation of CVE-2025-29908 in the wild and no public exploit code.
Sources
Also known as GHSA-hqqc-jr88-p6x2.