A critical vulnerability has been identified in LSQUIC, the QUIC and HTTP/3 library used in LiteSpeed Web Server (LSWS), OpenLiteSpeed (OLS), and LiteSpeed Web ADC (LSADC).
This advisory also covers a separate vulnerability in the LiteSpeed Cache module for PrestaShop. See the second advisory below.
Advisory 1: LSQUIC
A use-after-free vulnerability was reported to us through a secure channel. Exploiting it can cause a crash, information disclosure, or memory corruption. In the worst case, it can lead to remote code execution (RCE).
Servers are affected only if HTTP/3 is enabled. The vulnerability can be exploited remotely, and no authentication is required.
Affected products: LiteSpeed Web Server (Enterprise), OpenLiteSpeed, LiteSpeed Web ADC
Affected versions: All versions prior to the fixed versions listed under “Action Required” below
Status: Fix available to customers now. The public LSQUIC repository has not yet been updated.
Severity: Critical (CVSS [3.1 / 4.0] score 9.2). A CVE ID has been requested and will be disclosed publicly along with the fix.
ACTION REQUIRED (immediately)
We strongly recommend upgrading all affected installations to the following versions or later:
LiteSpeed Web Server (Enterprise) - v6.3.7 build 8 or v6.4.0 RC2 build 6
OpenLiteSpeed - v1.9.4
LiteSpeed Web ADC - v3.4.1
If you run LSWS 6.3.x, upgrade to v6.3.7 build 8. If you run the 6.4 release candidate branch, upgrade to v6.4.0 RC2 build 6.
Why we're notifying you before the public disclosure
We have not yet published the fix to the public LSQUIC repository. We are holding it back on purpose, to give you time to update your servers before the vulnerability details become public. Once the fix is published, the changes will be visible to anyone, including attackers, and unpatched servers will be at greater risk.
Planned public disclosure date: November 16, 2026
What the update includes
• [Security] The default configuration has been changed to stop the attack vector.
Interim mitigation (optional)
If you can’t upgrade right away, you can disable HTTP/3. While HTTP/3 is disabled, clients will fall back to HTTP/2 or HTTP/1.1. Upgrading is still strongly recommended.
Post-upgrade steps (LSQUIC)
After upgrading, please:
• Confirm the new version is running.
• Verify that HTTP/3 connections are working as expected.
Advisory 2: LiteSpeed Cache module for PrestaShop
This section applies only if you run PrestaShop with the LiteSpeed Cache module. If you don't, you can skip it.
We have also patched a critical vulnerability in the LiteSpeed Cache module for PrestaShop. A CVE is forthcoming. This fix is separate from the LSQUIC issue above, and it is already public in module v1.6.2, released October 30, 2026.
Impact: An unauthenticated attacker could send specially crafted requests to a store that cause the server to process attacker-supplied content, potentially giving the attacker full control of the store and access to customer and payment data.
Affected: All versions prior to v1.6.2
Fixed in: LiteSpeed Cache for PrestaShop v1.6.2 or later
Severity: Critical
ACTION REQUIRED (immediately)
Update to the latest version of the LiteSpeed Cache module for PrestaShop (v1.6.2 or higher) immediately.
