Description
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
Published: 2026-09-30
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Potential exploitation via internal redirect validation flaw
Action: Upgrade Server
AI Analysis

Impact

The flaw is a CWE-174 input validation weakness. The vulnerability in LiteSpeed Web Server results from an incorrect validation of internal redirect URLs in a specific corner case. This flaw can cause the server to accept an internal redirect that should be rejected, potentially exposing internal URLs or actions that are not intended to be reachable through the external-facing interface.

Affected Systems

The issue affects LiteSpeed Web Server versions earlier than 6.3.7 build 1 on systems running the LiteSpeed Web Server product from LiteSpeed Tech.

Risk and Exploitability

With a CVSS score of 9.4 this flaw is considered high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered by a crafted HTTP request that forces an internal redirect, making the attack surface effectively remote (inferred). The lack of a known exploit and the high score still indicate significant risk when the server is exposed publicly.

Generated by OpenCVE AI on September 30, 2026 at 20:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑recommended upgrade to version 6.3.7 build 1 or later, which includes the internal redirect validation fix.
  • If an upgrade cannot be applied immediately, disable internal redirect functionality or restrict the permitted redirect targets using the server configuration directives to prevent unauthorized internal URLs from being used.
  • Monitor web server logs for abnormal redirect activity and alert on repeated unexpected redirect patterns to detect potential exploitation attempts.

Generated by OpenCVE AI on September 30, 2026 at 20:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Title Internal Redirect Validation Flaw in LiteSpeed Web Server

Wed, 30 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Description LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
First Time appeared Litespeedtech
Litespeedtech litespeed Web Server
Weaknesses CWE-174
CPEs cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*
Vendors & Products Litespeedtech
Litespeedtech litespeed Web Server
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Litespeedtech Litespeed Web Server
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-30T16:30:52.184Z

Reserved: 2026-09-18T20:40:05.869Z

Link: CVE-2026-93903

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T14:17:37.060

Modified: 2026-09-30T17:23:08.953

Link: CVE-2026-93903

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T04:15:16Z

Weaknesses
  • CWE-174

    Double Decoding of the Same Data