Openlitespeed
Monthly
OpenLiteSpeed through 1.9.4 allows unauthenticated remote attackers to bypass virtual-host client-certificate (mTLS) enforcement on HTTP/3/QUIC listeners when one instance hosts both an mTLS-protected virtual host and a non-mTLS virtual host. QuicStream inherits a verifyContext() implementation that always returns true, so a crafted QUIC request can present the non-mTLS host's SNI alongside a protected Host header and reach content that should require a client certificate. The CVSS 4.0 score is 8.2 with confidentiality-only impact, the priority label is this_week, no CISA KEV entry is provided, and a public research write-up is referenced but working exploit code is not confirmed.
OS command injection in OpenLiteSpeed and LSWS Enterprise web servers from LiteSpeed Technologies allows administrative users to execute arbitrary operating system commands on the host. The flaw affects all versions of both products per ENISA EUVD and was reported by JPCERT/CC via JVN. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 37th percentile), but the high CVSS 4.0 score (8.6) reflects full confidentiality, integrity, and availability impact on the underlying host.
Local privilege escalation in OpenLiteSpeed before 1.9.3 lets an attacker who already controls the low-privileged 'nobody' web-server process escalate to root by exploiting a time-of-check/time-of-use race in the admin/misc/lsup.sh auto-update script, which fetches, extracts and executes update packages as root from the nobody-writable /usr/local/lsws/autoupdate/ directory with no integrity verification. Realistic exploitation requires three preconditions together - existing code execution as 'nobody', an administrator-triggered update, and winning the race to replace the package before root runs its install.sh - so the flaw is genuine but conditional rather than remotely weaponizable; no public exploit code has been identified at time of analysis (no CISA KEV entry). The vendor fix in 1.9.3 adds SHA-256 checksum verification of downloaded packages, a mode-0700 update directory that refuses symlinks, HTTPS-only downloads with redirects refused, and a proper lock file.
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenLiteSpeed before 1.8.1 mishandles chunked encoding. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Use-after-free vulnerability in Open Litespeed before 1.3.10. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OpenLiteSpeed through 1.9.4 allows unauthenticated remote attackers to bypass virtual-host client-certificate (mTLS) enforcement on HTTP/3/QUIC listeners when one instance hosts both an mTLS-protected virtual host and a non-mTLS virtual host. QuicStream inherits a verifyContext() implementation that always returns true, so a crafted QUIC request can present the non-mTLS host's SNI alongside a protected Host header and reach content that should require a client certificate. The CVSS 4.0 score is 8.2 with confidentiality-only impact, the priority label is this_week, no CISA KEV entry is provided, and a public research write-up is referenced but working exploit code is not confirmed.
OS command injection in OpenLiteSpeed and LSWS Enterprise web servers from LiteSpeed Technologies allows administrative users to execute arbitrary operating system commands on the host. The flaw affects all versions of both products per ENISA EUVD and was reported by JPCERT/CC via JVN. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 37th percentile), but the high CVSS 4.0 score (8.6) reflects full confidentiality, integrity, and availability impact on the underlying host.
Local privilege escalation in OpenLiteSpeed before 1.9.3 lets an attacker who already controls the low-privileged 'nobody' web-server process escalate to root by exploiting a time-of-check/time-of-use race in the admin/misc/lsup.sh auto-update script, which fetches, extracts and executes update packages as root from the nobody-writable /usr/local/lsws/autoupdate/ directory with no integrity verification. Realistic exploitation requires three preconditions together - existing code execution as 'nobody', an administrator-triggered update, and winning the race to replace the package before root runs its install.sh - so the flaw is genuine but conditional rather than remotely weaponizable; no public exploit code has been identified at time of analysis (no CISA KEV entry). The vendor fix in 1.9.3 adds SHA-256 checksum verification of downloaded packages, a mode-0700 update directory that refuses symlinks, HTTPS-only downloads with redirects refused, and a proper lock file.
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenLiteSpeed before 1.8.1 mishandles chunked encoding. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Use-after-free vulnerability in Open Litespeed before 1.3.10. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.