{"id":"CVE-2026-115482","aliases":["EUVD-2026-108211","GHSA-mhr4-9xv4-xpwf"],"status":"published","title":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because...","description":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00446,"percentile":0.39222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-10-22T15:07:30Z","modified":"2026-10-28T10:46:14Z","products":[{"vendor":"litespeedtech","product":"lsquic"}],"references":[{"url":"https://github.com/litespeedtech/lsquic/pull/666","tags":["fix"]},{"url":"https://github.com/litespeedtech/lsquic/compare/v4.8.2...v4.9.0","tags":["web"]},{"url":"https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115482","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mhr4-9xv4-xpwf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115482.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-115482","description":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.","status":"published","published":"2026-10-22T15:07:30.961Z","modified":"2026-10-22T19:00:31.416Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:20:01.618694Z"}],"euvd":[{"id":"EUVD-2026-108211","description":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.","status":"published","published":"2026-10-22T15:07:30Z","modified":"2026-10-22T19:00:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:34.021826Z"}],"ghsa":[{"id":"GHSA-mhr4-9xv4-xpwf","title":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because...","description":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.","status":"published","published":"2026-10-22T18:39:33Z","modified":"2026-10-22T18:39:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:14:17.600276Z"}],"nvd":[{"id":"CVE-2026-115482","description":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.","status":"published","published":"2026-10-22T16:17:35.49Z","modified":"2026-10-22T19:17:48.1Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:13:02.724605Z"}],"osv":[{"id":"CVE-2026-115482","description":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.","status":"published","published":"2026-10-22T15:07:30.961Z","modified":"2026-10-28T10:46:14.518441442Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:56.675758Z"}]}}