CRITICAL 9.4 NVD
CVE-2026-93903
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
References
- https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1
- https://www.litespeedtech.com/products/litespeed-web-server/release-log
This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-09-30 via NVD.
Risk Timeline
CVE Disclosed2026-09-30 · -1 days ago
Remediation Resources
Official Advisory
www.litespeedtech.com/products/litespeed-web-server/release-logAnalysis & PoC
docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1
vulnfeed aggregates 9449 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.