Live › vulnerability › CVE-2026-115482
Go to dashboardlsquic, a QUIC and HTTP/3 library, does not limit how many header sets it buffers, so a peer can send QPACK data that makes it use excessive memory. An attacker can exhaust memory on a server or client that speaks HTTP/3 through lsquic, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications and servers that embed lsquic for HTTP/3 and accept connections from untrusted clients are exposed. Systems that do not use lsquic for HTTP/3, or that only run behind a proxy that terminates HTTP/3, can likely skip it.
No product ranges from the sources yet.
grep -ri lsquic in vendored code or your package lock.4.9.0; anything earlier is affected.4.9.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
This page as .md · .json · in your agent: get_signal("CVE-2026-115482")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.