{"id":"CVE-2025-54939","aliases":["EUVD-2025-23337","GHSA-839r-7hhg-xhqr"],"status":"published","title":"LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.","description":"LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00837,"percentile":0.58207,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-401","CWE-770"],"published":"2025-08-01T00:00:00Z","modified":"2026-11-11T02:47:52Z","exploits":[{"source":"pocgithub","id":"yohannslm/CVE-2025-54939","title":"yohannslm/CVE-2025-54939","date":"2025-08-27","url":"https://github.com/yohannslm/CVE-2025-54939"}],"products":[{"vendor":"litespeedtech","product":"litespeed_web_adc"},{"vendor":"litespeedtech","product":"litespeed_web_server"},{"vendor":"litespeedtech","product":"lsquic"},{"vendor":"litespeedtech","product":"openlitespeed"}],"references":[{"url":"https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3","tags":["Release Notes","web"]},{"url":"https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23","tags":["Release Notes","fix"]},{"url":"https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation/","tags":["Exploit","Third Party Advisory","article"]},{"url":"https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/","tags":["Vendor Advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54939","tags":["advisory"]},{"url":"https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation"},{"url":"https://blog.litespeedtech.com/2025/08/18/litespeed-security-update"},{"url":"https://github.com/advisories/GHSA-839r-7hhg-xhqr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54939.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-54939","description":"LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.","status":"published","published":"2025-08-01T00:00:00Z","modified":"2025-08-20T19:55:50.645Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2025-23337","description":"LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.","status":"published","published":"2025-08-01T00:00:00Z","modified":"2025-08-20T19:55:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:31:55.522078Z"}],"ghsa":[{"id":"GHSA-839r-7hhg-xhqr","title":"LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.","description":"LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.","status":"published","published":"2025-08-01T06:31:37Z","modified":"2025-08-27T15:34:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-401","CWE-770"],"updated_at":"2026-11-02T15:03:24.943278Z"}],"nvd":[{"id":"CVE-2025-54939","description":"LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.","status":"published","published":"2025-08-01T06:15:28.86Z","modified":"2026-06-17T09:40:57.463Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770","CWE-401"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"CVE-2025-54939","description":"LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.","status":"published","published":"2025-08-01T00:00:00Z","modified":"2026-11-11T13:05:02.768310728Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-11T03:22:28.447808Z"}]}}