TI-2025-16832 Aliases CVE-2025-23020 GHSA-9f57-9rhg-4hvm

An issue was discovered in Kwik before 0.10.1.

LOW 31CWE-407Published 2025-02-20 · Updated 2025-02-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-407.

Summary

An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00579 47th percentileScored 2026-11-07

Fix Fixed Kwik (ptrd): 0.10.1tech.kwik:kwik (Maven): 0.10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ptrd	Kwik	before 0.10.1	0.10.1	Patch available	CNA
—	tech.kwik:kwik (Maven)	before 0.10.1	0.10.1	Patch available	GHSA-9f57-9rhg-4hvm

Kwik Vendorptrd Affected before 0.10.1 Fixed in 0.10.1 Patch available CNA
tech.kwik:kwik (Maven) Vendor— Affected before 0.10.1 Fixed in 0.10.1 Patch available GHSA-9f57-9rhg-4hvm

Remediation

Fix · CNA Kwik (ptrd) Fixed in 0.10.1
Fix · GHSA-9f57-9rhg-4hvm tech.kwik:kwik (Maven) Fixed in 0.10.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-23020
2026-10-03 Alias added: GHSA-9f57-9rhg-4hvm

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-23020

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences