HIGH 7.5 NVD
CVE-2026-115482
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrat
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
References
- https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers
- https://github.com/litespeedtech/lsquic/compare/v4.8.2...v4.9.0
- https://github.com/litespeedtech/lsquic/pull/666
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-10-22 via NVD.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.