NRDAX
Submit

← registry

NRDAX-T0349 - Unseeded Hash Collision DoS

compute_amp · active · first seen 2026-07-11

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

QUIC SCID hash-collision DoS (CVE-2025-47200): a flood of QUIC v1 Initial packets whose 8-byte Source Connection IDs are crafted to COLLIDE in the server's connection-ID hash table. The server keys ac

instances (1)

chainprimitivefidelityoriginreproducer (bundle)source
quic quic_scid_collision_hash_dos lab reverse-engineered-cve quic_scid_collision_hash_dos CVE-2025-47200 — NCC Group / Fox-IT technical advisory 'Hash Denial-of-Service Attack in Multiple QUIC Implementations'. QUIC servers index the connection table by the peer-chosen Source Connection ID (SCID, 8..20 bytes). Implementations hashing the SCID with a weak non-seeded function (FNV, xxHash, or a multiplicative `hash = hash*31 + char`) let an attacker pre-compute DISTINCT SCIDs that all collide into one bucket; opening many such connections degrades table insert/lookup from O(1) to O(n) (amortised O(n^2)), burning server CPU. Only SipHash resists it. Affected: xquic <= 1.8.1 (fixed 1.8.2), Apache Traffic Server <= 10.0.3 / 9.2.x <= 9.2.8, ngtcp2 1.10.0 example server (all CVE-2025-47200); kwik <= 0.10.0 (CVE-2025-23020, fixed 0.10.1); lsquic <= 4.0.12 (CVE-2025-24947, fixed 4.2.0); picoquic commit 3827b00 (CVE-2025-24946, fixed b80fd3f). https://www.nccgroup.com/research/technical-advisory-hash-denial-of-service-attack-in-multiple-quic-implementations/

related (compute_amp)

NRDAX-T0005 - Array Deserialization Memcpy Corruption active NRDAX-T0006 - Async Runtime Blocking VM Execution active NRDAX-T0013 - Bloom Filter Divide-By-Zero Crash active NRDAX-T0076 - Expensive Debug RPC Compute Amplification active NRDAX-T0101 - Handshake Crypto Validation Bypass Crash active NRDAX-T0122 - Integer Signedness Index OOB Crash active NRDAX-T0129 - Invalid Curve Point Panic active NRDAX-T0139 - Legacy Sighash Quadratic CPU Blowup active

cite

https://nrdax.com/techniques/NRDAX-T0349

plain

NRDAX Registry. Technique NRDAX-T0349.

bibtex
@misc{nrdax_NRDAX_T0349,
  title = {Unseeded Hash Collision DoS (NRDAX-T0349)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0349},
}
json (csl)
{
  "id": "nrdax-NRDAX-T0349",
  "type": "dataset",
  "title": "Unseeded Hash Collision DoS (NRDAX-T0349)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0349",
  "publisher": "NRDAX Registry"
}