CVE-2026-115482: High severity LiteSpeed LSQUIC vulnerability
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to headeroutdynamicentry and esmaxheaderlistsize.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using LSQUIC versions before 4.9.0 with its HTTP/3 implementation are affected. The issue is network-reachable and requires no attacker privileges or user interaction.
What is required to exploit this issue?
An attacker can trigger the condition remotely by using a QPACK amplification attack that causes excessive buffered header sets. The described impact is memory exhaustion and resulting denial of service.
What should be done if patching cannot happen immediately?
The provided data does not identify a configuration workaround or mitigation. Upgrading LSQUIC to 4.9.0 or later is the indicated remediation.
How can I determine whether an instance is affected?
Check the LSQUIC version in use and whether HTTP/3 is enabled or used. Versions before 4.9.0 are affected according to the available information.