CVE-2025-24356 – UDP traffic amplification via fastd's fast reconnect feature

https://notcve.org/view.php?id=CVE-2025-24356

27 Jan 2025 — fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to ~90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake pack... • https://github.com/neocturne/fastd/commit/1f233bee76b722c0b3f9024f2c39c72e9f7e5843 • CWE-405: Asymmetric Resource Consumption (Amplification) •