Is CVE-2026-115482 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115482 being exploited in the wild.

How severe is CVE-2026-115482?

High severity, with a CVSS score of 7.5, published 22 October 2026.

Which products and versions are affected?

LiteSpeed Technologies Lsquic before 4.9.0.

Is there a fix for CVE-2026-115482?

Yes: fixed in lsquic 4.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115482 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115482?

Check whether you run LiteSpeed Technologies Lsquic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115482: lsquic HTTP/3 memory exhaustion via QPACK amplification

CVE-2026-115482 · Severity: high · CVSS 7.5 · Published 2026-10-22

lsquic is an HTTP/3 protocol library used in many web applications and services. A remote attacker can send specially crafted HTTP/3 requests that force servers to allocate far more memory than the requests themselves consume, potentially causing denial of service or server crashes. A single connection is sufficient to exhaust available memory on a default-configured server.

Vendors: LiteSpeed Technologies.

Quick answers

Is CVE-2026-115482 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115482 being exploited in the wild.
How severe is CVE-2026-115482?: High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?: LiteSpeed Technologies Lsquic before 4.9.0.
Is there a fix for CVE-2026-115482?: Yes: fixed in lsquic 4.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115482 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115482?: Check whether you run LiteSpeed Technologies Lsquic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: lsquic 4.9.0

Technical details

The vulnerability exists in lsquic's QPACK header decompression implementation, which fails to enforce cumulative limits on decoded header size as specified in RFC 9114 Section 4.2.2. An attacker can exploit a dynamic table variant where a large entry (~4 KiB) is inserted once then referenced thousands of times with single-byte indexed references, each forcing a fresh allocation and copy of the full entry—resulting in 600–1800x memory amplification. This is a remote, unauthenticated attack requiring no user interaction.

Affected products

LiteSpeed Technologies lsquic before 4.9.0

Timeline

2026-10-20: disclosed: FoxIO public research into QPACK amplification attacks across HTTP/3 implementations
2026-07-16: patched: lsquic 4.9.0 released with limit on buffered header sets
2026-10-22: advisory: CVE-2026-115482 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.