Memory Consumption Vulnerability in lsquic by LiteSpeed Technologies

CVE-2026-115482

What is CVE-2026-115482?

In lsquic versions before 4.9.0, the HTTP/3 implementation is susceptible to excessive memory usage due to unbounded buffered header sets. This vulnerability presents a risk for QPACK amplification attacks, where an attacker can manipulate header entries leading to significant resource consumption, potentially impacting service availability. The issue resides in the configuration parameters 'header_out_dynamic_entry' and 'es_max_header_list_size', which do not sufficiently limit the number of buffered header sets. Users of affected versions should upgrade to the latest version to mitigate this vulnerability.

References