Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-115482 Overview
CVE-2026-115482 affects the LiteSpeed QUIC (lsquic) library versions before 4.9.0. The HTTP/3 implementation fails to limit the number of buffered header sets, enabling attackers to consume excessive server memory through a QPACK amplification attack. The flaw involves the header_out_dynamic_entry function and the es_max_header_list_size setting. Remote unauthenticated attackers can trigger memory exhaustion on affected servers, resulting in denial of service. The issue is categorized as [CWE-770] Allocation of Resources Without Limits or Throttling.
Critical Impact
Unauthenticated remote attackers can exhaust server memory on any HTTP/3 service built on lsquic, causing denial of service without privileges or user interaction.
Affected Products
- LiteSpeed QUIC library (lsquic) versions prior to 4.9.0
- HTTP/3 server implementations built on vulnerable lsquic releases
- Applications linking lsquic for QUIC and QPACK handling
Discovery Timeline
- 2026-10-22 - CVE CVE-2026-115482 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-115482
Vulnerability Analysis
The vulnerability resides in the HTTP/3 header processing path of lsquic. The library accepts and buffers inbound header sets without enforcing an upper bound on the total number of concurrently buffered sets. An attacker can leverage QPACK, the header compression format used by HTTP/3, to send compact encoded references that expand into large header lists on the server. This asymmetry between network bytes sent and memory allocated server-side forms the amplification primitive. See the FoxIO Blog on QPACK Attacks for the broader attack class.
Root Cause
The root cause is a missing resource constraint in the HTTP/3 header buffering logic, specifically around header_out_dynamic_entry and the es_max_header_list_size configuration. While es_max_header_list_size governs the size of an individual header list, no corresponding cap exists on how many pending header sets a single connection or stream can hold. The result is unbounded memory allocation under adversarial input, a textbook [CWE-770] condition.
Attack Vector
An attacker establishes an HTTP/3 session with the target server over QUIC. They then open streams and send QPACK-encoded headers crafted to expand into large header lists while deferring stream completion. By repeating this across many streams, the attacker forces the server to retain growing amounts of buffered header data. Memory consumption grows faster than the bandwidth cost to the attacker, driving the server toward resource exhaustion. The attack requires no authentication and no user interaction.
For the upstream fix, review the GitHub lsquic Pull Request #666 and the GitHub lsquic Version Comparison.
Detection Methods for CVE-2026-115482
Indicators of Compromise
- Sustained growth in resident memory of HTTP/3 server processes without a matching increase in completed requests.
- Elevated counts of open QUIC streams per connection with headers received but requests not finalized.
- Client source addresses opening many concurrent HTTP/3 streams containing large QPACK-encoded header lists.
Detection Strategies
- Instrument lsquic-based servers to log per-connection buffered header set counts and raise alerts above baseline thresholds.
- Correlate QUIC connection telemetry with host memory metrics to flag amplification patterns.
- Deploy network sensors capable of parsing HTTP/3 and QPACK to identify header lists that expand disproportionately versus wire size.
Monitoring Recommendations
- Track process memory, open file descriptors, and QUIC connection counts on all HTTP/3 edge nodes.
- Alert on repeated OOM-killer events or sudden drops in HTTP/3 request completion rates.
- Monitor UDP traffic to port 443 for anomalous source concentration and connection churn.
How to Mitigate CVE-2026-115482
Immediate Actions Required
- Upgrade lsquic to version 4.9.0 or later on every host that exposes HTTP/3.
- Inventory downstream products and container images that embed lsquic and schedule rebuilds against the fixed release.
- Apply rate limiting and per-source connection caps at the edge until patching completes.
Patch Information
The fix is included in lsquic 4.9.0. The upstream change is tracked in GitHub lsquic Pull Request #666, and the full diff between vulnerable and fixed releases is available via the GitHub lsquic Version Comparison. Operators should rebuild any statically linked binaries after updating.
Workarounds
- Lower es_max_header_list_size to constrain the maximum size of any single header list processed.
- Enforce strict per-connection stream concurrency limits at the HTTP/3 layer or upstream load balancer.
- Temporarily disable HTTP/3 and fall back to HTTP/2 over TLS where patching cannot be performed immediately.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
