CVE-2026-115482
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
| CWE | CWE-770 |
| Vendor | litespeedtech |
| Product | lsquic |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for litespeedtech lsquic
Be the first to know when new high vulnerabilities affecting litespeedtech lsquic are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
litespeedtech / lsquic
0 < 4.9.0