Live › vulnerability › CVE-2026-119559
OpenLiteSpeed through 1.9.4 accepts HTTP/3 connections without enforcing a virtual host's client certificate requirement, because a certificate verification routine always returns true. An unauthenticated remote attacker can send a non-mTLS host's SNI with a protected Host header and reach content meant to require a client certificate.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Exposure requires OpenLiteSpeed through 1.9.4 serving HTTP/3 with at least one virtual host protected by client certificate requirements. Servers that do not use mTLS on virtual hosts, or that do not serve HTTP/3, are not described as affected by the sources.
No product ranges from the sources yet.
1.9.4 range stated in the advisory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.
This page as .md · .json · in your agent: get_signal("CVE-2026-119559")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.