Is CVE-2026-119559 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119559 being exploited in the wild.

How severe is CVE-2026-119559?

Medium severity, with a CVSS score of 5.9, published 30 October 2026.

Which products and versions are affected?

LiteSpeed Technologies OpenLiteSpeed through 1.9.4.

Is there a fix for CVE-2026-119559?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119559 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119559?

Check whether you run LiteSpeed Technologies OpenLiteSpeed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119559: OpenLiteSpeed HTTP/3 authentication bypass in mTLS verification

CVE-2026-119559 · Severity: medium · CVSS 5.9 · Published 2026-10-30

OpenLiteSpeed is a high-performance web server used to host websites and applications. An attacker can bypass client certificate authentication on HTTP/3 connections and access protected content that should require a valid certificate. This allows unauthenticated users to reach restricted virtual hosts and their data on servers configured with certificate-based access control.

Vendors: LiteSpeed Technologies.

Quick answers

Is CVE-2026-119559 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119559 being exploited in the wild.
How severe is CVE-2026-119559?: Medium severity, with a CVSS score of 5.9, published 30 October 2026.
Which products and versions are affected?: LiteSpeed Technologies OpenLiteSpeed through 1.9.4.
Is there a fix for CVE-2026-119559?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119559 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119559?: Check whether you run LiteSpeed Technologies OpenLiteSpeed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The QuicStream class in OpenLiteSpeed's HTTP/3 implementation inherits a verifyContext() method from HioCrypto that always returns true, failing to validate whether a connection matches the required client certificate for a protected virtual host. An unauthenticated remote attacker can exploit this by sending an HTTP/3 request with an SNI from an unprotected host and a Host header pointing to a protected vhost configured with clientVerify Require. The TCP/HTTP/2 code path correctly performs pointer-equality verification and rejects such requests, but HTTP/3 bypasses this check.

Affected products

LiteSpeed Technologies OpenLiteSpeed through 1.9.4

Timeline

2026-10-12: disclosed
2026-10-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.