LiteSpeed’s HTTP/3 implementation, prior to release 4.9.0, does not impose limits on the number of buffered header sets. An attacker can exploit this by sending a QPACK amplification payload that causes the server to allocate large amounts of memory, potentially exhausting the system’s resources. This flaw aligns with CWE‑770, reflecting a failure to properly manage resources. The consequence is a denial of service as legitimate connections may be dropped or the server may crash due to memory exhaustion.

The vulnerability impacts LiteSpeed Technologies’ lsquic library in all versions before 4.9.0. The affected product is the HTTP/3 engine shipped within the lsquic component. No additional vendor or product variation is specified.

The CVSS score of 7.5 indicates a considerable severity, and although EPSS is not available, the nature of an amplification attack suggests that exploitation is feasible over the network without authentication. The vulnerability is not listed in CISA’s KEV catalog, but given the high impact and the ubiquity of HTTP/3 traffic, the risk remains significant. The likely attack vector is external: an attacker sends large, maliciously crafted QPACK frames to a target running an affected lsquic version, aiming to force the server into memory exhaustion and disrupt service.