In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
| Vendor | Product | Versions |
|---|---|---|
| litespeedtech | lsquic | 0 |
Loading…
Clarified affected versions as up to 4.8.x, updated severity from HIGH to MEDIUM (problematic classification), and corrected CWE from CWE-770 to CWE-787 (out-of-bounds write vs buffer overflow).
Initial creation
