A critical vulnerability has been identified in LSQUIC, the QUIC and HTTP/3 library used in LiteSpeed Web Server (LSWS), OpenLiteSpeed (OLS), and LiteSpeed Web ADC (LSADC).
This advisory also covers a separate vulnerability in the LiteSpeed Cache module for PrestaShop. See the second advisory below.
[td]Advisory 1: LSQUIC[/td]
A use-after-free vulnerability was reported to us through a secure channel. Exploiting it can cause a crash, information disclosure, or memory corruption. In the worst case, it can lead to remote code execution (RCE).
Servers are affected only if HTTP/3 is enabled. The vulnerability can be exploited remotely, and no authentication is required.
[td]Affected products: LiteSpeed Web Server (Enterprise), OpenLiteSpeed, LiteSpeed Web ADC Affected versions: All versions prior to the fixed versions listed under "Action Required" below Status: Fix available to customers now. The public LSQUIC repository has not yet been updated. Severity:Critical (CVSS [3.1 / 4.0] score 9.2). A CVE ID has been requested and will be disclosed publicly along with the fix.[/td]
ACTION REQUIRED (immediately) We strongly recommend upgrading all affected installations to the following versions or later:
LiteSpeed Web Server (Enterprise)
v6.3.7 build 8 or v6.4.0 RC2 build 6
OpenLiteSpeed
v1.9.4
LiteSpeed Web ADC
v3.4.1
[td]Product[/td][td]Fixed version[/td]
If you run LSWS 6.3.x, upgrade to v6.3.7 build 8. If you run the 6.4 release candidate branch, upgrade to v6.4.0 RC2 build 6. Why we're notifying you before the public disclosure We have not yet published the fix to the public LSQUIC repository. We are holding it back on purpose, to give you time to update your servers before the vulnerability details become public. Once the fix is published, the changes will be visible to anyone, including attackers, and unpatched servers will be at greater risk.
[td]Planned public disclosure date: November 16, 2026
• Please upgrade before this date.
• Please do not share the details of the LSQUIC vulnerability publicly until we've announced the disclosure.
• If you build LSQUIC from source or rely on the public repository for your own software, the fix won't be available there until the disclosure date. Please contact us at [email protected] for early access.[/td]
What the update includes • [Security] The default configuration has been changed to stop the attack vector. Interim mitigation (optional) If you can't upgrade right away, you can disable HTTP/3. While HTTP/3 is disabled, clients will fall back to HTTP/2 or HTTP/1.1. Upgrading is still strongly recommended. Post-upgrade steps (LSQUIC) After upgrading, please:
• Confirm the new version is running.
• Verify that HTTP/3 connections are working as expected.
[td]Advisory 2: LiteSpeed Cache module for PrestaShop[/td]
This section applies only if you run PrestaShop with the LiteSpeed Cache module. If you don't, you can skip it. We have also patched a critical vulnerability in the LiteSpeed Cache module for PrestaShop. A CVE is forthcoming. This fix is separate from the LSQUIC issue above, and it is already public in module v1.6.2, released October 30, 2026. Impact: An unauthenticated attacker could send specially crafted requests to a store that cause the server to process attacker-supplied content, potentially giving the attacker full control of the store and access to customer and payment data.
[td]Affected: All versions prior to v1.6.2 Fixed in: LiteSpeed Cache for PrestaShop v1.6.2 or later
Severity:Critical[/td]
If your store may have been exposed, then in addition to updating:
• Review administrator accounts and installed modules for unfamiliar entries.
• Rotate the database and other credentials stored in your site configuration.
