CVE-2025-29908

Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This vulnerability is fixed in 0.0.71.Final.

• CWE-407

• https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
• https://github.com/netty/netty-incubator-codec-quic/commit/e059bd9b78723f8b035e0c547e42ce263f03461c
• https://github.com/netty/netty-incubator-codec-quic/security/advisories/GHSA-hqqc-jr88-p6x2

Published

Mar 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29902Remote code execution that allows unauthorized users to exec…10
• CVE-2025-29903In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic …7.8
• CVE-2025-29904In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was…5.3
• CVE-2025-29905A vulnerability has been identified in TeleControl Server Ba…8.8
• CVE-2025-29906Finit is a fast init for Linux systems. Versions starting fr…8.6
• CVE-2025-29907jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2025-29909CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-2991A vulnerability classified as critical has been found in Ten…6.9
• CVE-2025-29910CryptoLib provides a software-only solution using the CCSDS …7.5
• CVE-2025-29911CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-29912CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-29913CryptoLib provides a software-only solution using the CCSDS …9.8