GCVE - cpe:2.3:a:litespeedtech:lsquic:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:litespeedtech:lsquic:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Litespeedtech (`17a5e0b8-e24b-5a2d-86af-9f892cc83a4e`)
Product	Lsquic (`81e756c7-4d73-5b54-b222-06f313be5b6f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/litespeedtech/lsquic-qir`	purl2cpe	2026-06-01 10:12:32.722965
`pkg:github/litespeedtech/lsquic`	purl2cpe	2026-06-01 10:12:32.722967

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-54939`	vulnerable	2026-06-08 07:33:13.810470	Details available MEDIUM (5.3) LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. Published: 2025-08-01T00:00:00.000Z Updated: 2025-08-20T19:55:50.645Z Open on db.gcve.eu Reference links https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3 https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23 https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation/ https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-24947`	vulnerable	2026-06-08 07:12:50.199899	Details available MEDIUM (5.3) A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage. Published: 2025-02-20T00:00:00.000Z Updated: 2025-02-20T20:19:05.607Z Open on db.gcve.eu Reference links https://xxhash.com https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory https://github.com/litespeedtech/lsquic/releases/tag/v4.2.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-25678`	vulnerable	2026-06-08 06:31:23.718105	Details available In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled. Published: 2024-02-09T00:00:00.000Z Updated: 2025-06-20T20:26:13.694Z Open on db.gcve.eu Reference links https://www.rfc-editor.org/rfc/rfc9001 https://github.com/litespeedtech/lsquic/commit/515f453556c99d27c4dddb5424898dc1a5537708 https://github.com/litespeedtech/lsquic/releases/tag/v4.0.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-30592`	vulnerable	2026-06-08 05:43:38.615116	Details available liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY. Published: 2022-05-11T22:12:10.000Z Updated: 2024-08-03T06:56:13.145Z Open on db.gcve.eu Reference links https://github.com/litespeedtech/lsquic/releases/tag/v3.1.0 https://github.com/litespeedtech/lsquic/commit/a74702c630e108125e71898398737baec8f02238#diff-73a138506faffe5f1efa8586346ab573c88e9dd2097774ecca5949a718a57cae	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.