Detections
Analytics
CVE-2026-115482
high
Description
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
References
https://github.com/litespeedtech/lsquic/pull/666
https://github.com/litespeedtech/lsquic/compare/v4.8.2...v4.9.0
https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers