{"id":"CVE-2026-115482","kind":"vulnerability","aliases":["CVE-2026-115482"],"related":[],"title":"lsquic HTTP/3: unbounded buffered header sets exhaust server memory","description":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.","summary":"lsquic, a QUIC and HTTP/3 library, does not limit how many header sets it buffers, so a peer can send QPACK data that makes it use excessive memory. An attacker can exhaust memory on a server or client that speaks HTTP/3 through lsquic, causing denial of service.","severity":"high","cvss":7.5,"epss":0.00446,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http3","lsquic","package","quic","self-hosted"],"not_affected_if":["behind-proxy","no-http3"],"how_to_check":"- Find lsquic in your dependencies or build, for example `grep -ri lsquic` in vendored code or your package lock.\n- Check the installed lsquic version against `4.9.0`; anything earlier is affected.","fix":"- Upgrade lsquic to `4.9.0` or later.\n- Until upgraded, limit HTTP/3 exposure or put a memory limit on the process running it.","status":"open","published_at":"2026-10-22T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:15:10+00:00","updated_at":"2026-10-25T03:15:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:15:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade lsquic to `4.9.0` or later.\n- Until upgraded, limit HTTP/3 exposure or put a memory limit on the process running it.","reach":"internet","title":"lsquic HTTP/3: unbounded buffered header sets exhaust server memory","impact":"low","summary":"lsquic, a QUIC and HTTP/3 library, does not limit how many header sets it buffers, so a peer can send QPACK data that makes it use excessive memory. An attacker can exhaust memory on a server or client that speaks HTTP/3 through lsquic, causing denial of service.","category":"package","nicknames":[],"who_cares":["lsquic","http3","quic","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote peer exhausts server memory, causing denial of service.","analyst_note":"Check the lsquic 4.9.0 release notes or advisory for the exact fix and whether a workaround setting such as es_max_header_list_size exists.","how_to_check":"- Find lsquic in your dependencies or build, for example `grep -ri lsquic` in vendored code or your package lock.\n- Check the installed lsquic version against `4.9.0`; anything earlier is affected.","needs_analyst":true,"not_affected_if":["no-http3","behind-proxy"],"who_is_affected":"Applications and servers that embed lsquic for HTTP/3 and accept connections from untrusted clients are exposed. Systems that do not use lsquic for HTTP/3, or that only run behind a proxy that terminates HTTP/3, can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":3353,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115482':12A,15A '-2026':11A,14A '4.9.0':73C 'amount':81C 'amplif':99C 'attack':52B,100C 'buffer':4A,37B,88C 'caus':66B 'client':60B 'cve':10A,13A 'data':44B 'demonstr':95C 'denial':67B 'dynam':107C 'entri':108C 'es':110C 'excess':49B,80C 'exhaust':7A,54B 'header':5A,34B,89C,105C,112C 'host':22B 'http/3':2A,27B,63B,75C 'http3':16B 'implement':76C 'librari':28B 'limit':31B,93C 'list':113C 'lsquic':1A,17B,23B,65B,71C 'make':46B 'mani':33B 'max':111C 'memori':9A,50B,55B,83C 'number':86C 'packag':18B 'peer':40B 'qpack':43B,98C 'quic':19B,25B 'relat':103C 'self':21B 'self-host':20B 'send':42B 'server':8A,58B 'servic':69B 'set':6A,35B,90C 'size':114C 'speak':62B 'unbound':3A 'use':48B,78C","nicknames":[],"mitigations":[],"who_affected":"Applications and servers that embed lsquic for HTTP/3 and accept connections from untrusted clients are exposed. Systems that do not use lsquic for HTTP/3, or that only run behind a proxy that terminates HTTP/3, can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T16:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115482","severity":null,"published_at":"2026-10-22T16:17:35+00:00","modified_at":"2026-10-22T19:17:48+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115482","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115482","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}