Lsquic
Monthly
Unauthenticated memory exhaustion in LiteSpeed's lsquic HTTP/3 stack (all versions before 4.9.0) allows a remote attacker to drive a server or client into high memory use and ultimately denial of service by sending header blocks that pile up completed header sets faster than the application claims them, a technique the reporters call a QPACK amplification attack. Any lsquic-based endpoint that exposes HTTP/3 over UDP/QUIC is affected with default settings, since the library applied no cap on buffered header sets; no credentials or user interaction are needed and the vector scores 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only). There is confirmed vendor activity in the form of upstream pull request 666 and the 4.9.0 release notes, and a public research write-up from FoxIO describes the attack class, but no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Unauthenticated memory exhaustion in LiteSpeed's lsquic HTTP/3 stack (all versions before 4.9.0) allows a remote attacker to drive a server or client into high memory use and ultimately denial of service by sending header blocks that pile up completed header sets faster than the application claims them, a technique the reporters call a QPACK amplification attack. Any lsquic-based endpoint that exposes HTTP/3 over UDP/QUIC is affected with default settings, since the library applied no cap on buffered header sets; no credentials or user interaction are needed and the vector scores 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only). There is confirmed vendor activity in the form of upstream pull request 666 and the 4.9.0 release notes, and a public research write-up from FoxIO describes the attack class, but no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.