CVE-2026-115482
CVE-2026-115482
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
lsquic
- Versions
- ≥ 0, < 4.9.0: Affected (semver)
Update to 4.9.0