CVE-2026-115482

Published: Oct 22, 2026Modified: Oct 22, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: MITRE (Secondary)

Description

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (3)

https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers

Source: cve@mitre.org

https://github.com/litespeedtech/lsquic/compare/v4.8.2...v4.9.0

Source: cve@mitre.org

https://github.com/litespeedtech/lsquic/pull/666

Source: cve@mitre.org

Timeline

No history available yet.