logo

Database

Improper resource allocation In io.netty.incubator:netty-incubator-codec-quic

Description

Netty QUIC hash collision DoS attack An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).

See https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2025-299082. NVD-2025-299083. OSV-2025-299084. GHSA-hqqc-jr88-p6x25. GCVE-2025-29908

References

1. https://github.com/netty/netty-incubator-codec-quic/security/advisories/GHSA-hqqc-jr88-p6x22. https://github.com/netty/netty-incubator-codec-quic/commit/e059bd9b78723f8b035e0c547e42ce263f03461c3. https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.