medium5.3
CVE-2025-23020
Kwik hash collision vulnerability
Impact
An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | tech.kwik:kwik | < 0.10.1 | 0.10.1 |
Affected products
| Product | Affected versions |
|---|---|
| Kwik | before 0.10.1. |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
- https://github.com/ptrd/kwik/releases/tag/v0.10.1
- https://github.com/advisories/GHSA-9f57-9rhg-4hvm
- https://nvd.nist.gov/vuln/detail/CVE-2025-23020
- https://github.com/ptrd/kwik/commit/b0733d72bad76bc5d8df2f4a7792ebb2539ebdc8