---
id: CVE-2026-115482
title: >-
  In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount
  of memory because the number of buffered header sets is not limited, as
  demonstrated by a QPACK amplification attack
summary: >-
  In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount
  of memory because the number of buffered header sets is not limited, as
  demonstrated by a QPACK amplification attack. This is related to
  header_out_dynamic_ent…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-770
vendor: litespeedtech
product: lsquic
affected:
  - lsquic < 4.9.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-22T18:34:24.530507Z'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:00:31.416Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115482'
references:
  - url: 'https://github.com/litespeedtech/lsquic/pull/666'
  - url: 'https://github.com/litespeedtech/lsquic/compare/v4.8.2...v4.9.0'
  - url: >-
      https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.373Z'
---

## Overview

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.

## Affected

- `lsquic < 4.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.