LiteSpeed security advisory: LSQUIC and LiteSpeed Cache for PrestaShop

N

nathany

Verified User
Joined
Jun 1, 2016
Messages
42
[td]URGENT — Security Advisory[/td]
A critical vulnerability has been identified in LSQUIC, the QUIC and HTTP/3 library used in LiteSpeed Web Server (LSWS), OpenLiteSpeed (OLS), and LiteSpeed Web ADC (LSADC).
This advisory also covers a separate vulnerability in the LiteSpeed Cache module for PrestaShop. See the second advisory below.
[td]Advisory 1: LSQUIC[/td]
A use-after-free vulnerability was reported to us through a secure channel. Exploiting it can cause a crash, information disclosure, or memory corruption. In the worst case, it can lead to remote code execution (RCE).
Servers are affected only if HTTP/3 is enabled. The vulnerability can be exploited remotely, and no authentication is required.
[td]Affected products: LiteSpeed Web Server (Enterprise), OpenLiteSpeed, LiteSpeed Web ADC
Affected versions: All versions prior to the fixed versions listed under "Action Required" below
Status: Fix available to customers now. The public LSQUIC repository has not yet been updated.
Severity: Critical (CVSS [3.1 / 4.0] score 9.2). A CVE ID has been requested and will be disclosed publicly along with the fix.[/td]
ACTION REQUIRED (immediately)
We strongly recommend upgrading all affected installations to the following versions or later:
LiteSpeed Web Server (Enterprise)v6.3.7 build 8 or v6.4.0 RC2 build 6
OpenLiteSpeedv1.9.4
LiteSpeed Web ADCv3.4.1
[td]Product[/td][td]Fixed version[/td]
If you run LSWS 6.3.x, upgrade to v6.3.7 build 8. If you run the 6.4 release candidate branch, upgrade to v6.4.0 RC2 build 6.
Why we're notifying you before the public disclosure
We have not yet published the fix to the public LSQUIC repository. We are holding it back on purpose, to give you time to update your servers before the vulnerability details become public. Once the fix is published, the changes will be visible to anyone, including attackers, and unpatched servers will be at greater risk.
[td]Planned public disclosure date: November 16, 2026
• Please upgrade before this date.
• Please do not share the details of the LSQUIC vulnerability publicly until we've announced the disclosure.
• If you build LSQUIC from source or rely on the public repository for your own software, the fix won't be available there until the disclosure date. Please contact us at [email protected] for early access.[/td]
What the update includes
• [Security] The default configuration has been changed to stop the attack vector.
Interim mitigation (optional)
If you can't upgrade right away, you can disable HTTP/3. While HTTP/3 is disabled, clients will fall back to HTTP/2 or HTTP/1.1. Upgrading is still strongly recommended.
Post-upgrade steps (LSQUIC)
After upgrading, please:
• Confirm the new version is running.
• Verify that HTTP/3 connections are working as expected.
[td]Advisory 2: LiteSpeed Cache module for PrestaShop[/td]
This section applies only if you run PrestaShop with the LiteSpeed Cache module. If you don't, you can skip it.
We have also patched a critical vulnerability in the LiteSpeed Cache module for PrestaShop. A CVE is forthcoming. This fix is separate from the LSQUIC issue above, and it is already public in module v1.6.2, released October 30, 2026.
Impact: An unauthenticated attacker could send specially crafted requests to a store that cause the server to process attacker-supplied content, potentially giving the attacker full control of the store and access to customer and payment data.
[td]Affected: All versions prior to v1.6.2
Fixed in: LiteSpeed Cache for PrestaShop v1.6.2 or later
Severity: Critical[/td]
ACTION REQUIRED (immediately)
Update to the latest version of the LiteSpeed Cache module for PrestaShop (v1.6.2 or higher) immediately.
Download v1.6.2+
If your store may have been exposed, then in addition to updating:
• Review administrator accounts and installed modules for unfamiliar entries.
• Rotate the database and other credentials stored in your site configuration.
Click to expand...
 
Last edited:
In theory you can push the updated version by adding a custom_versions setting temporarily:

perl -pi -e "s/litespeed:.*\n//" /usr/local/directadmin/custombuild/custom_versions.txt
echo "litespeed:6.3.7-8:" >> /usr/local/directadmin/custombuild/custom_versions.txt
cat /usr/local/directadmin/custombuild/custom_versions.txt
Click to expand...

Credits to the person that provided the above last time around in another Litespeed thread.
 
adam12 said:
I wonder if it's separate to the finding in this article (which for some reason has no CVE from LiteSpeed).

foxio.io

Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.
foxio.io foxio.io

If it's the same, I'm annoyed about the delay since it's been out for weeks now (I heard about it Oct 21).
Click to expand...
build 8 has been released November 3: https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-8
 
You must log in or register to reply here.
Back
Top