litespeedtech LSQUIC

• CVE-2026-115482 High 7.5 In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This 0.4%
• CVE-2025-54939 Medium 5.3 LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. 0.8%
• CVE-2025-24947 Medium 5.3 A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash 0.7%