CVE-2025-54939

Published: Aug 1, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

Affected (4)

Products: Litespeedtech: Litespeed Web Adc, Litespeed Web Server, Lsquic, Openlitespeed

4 products

Litespeed Web Adc

Litespeed Web Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Litespeedtech Litespeed Web Adc	Before 3.3.1
Litespeedtech Litespeed Web Server	Before 6.3.4
Litespeedtech Lsquic	Before 4.3.1
Litespeedtech Openlitespeed	Before 1.8.4

Related CWEs

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/

Source: cve@mitre.org

Vendor Advisory

https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3

Source: cve@mitre.org

Release Notes

https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23

Source: cve@mitre.org

Release Notes

https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation/

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.