Openlitespeed
Approved changes feed: RSS · Atom
cpe:2.3:a:litespeedtech:openlitespeed:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Litespeedtech (17a5e0b8-e24b-5a2d-86af-9f892cc83a4e) |
|---|---|
| Product | Openlitespeed (b67b3b4a-9063-5995-a1ac-e5cf535a8a31) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/litespeedtech/openlitespeed |
purl2cpe | 2026-06-01 10:12:32.770034 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-119559 |
vulnerable | 2026-11-03 10:17:11.977835 |
OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch
MEDIUM (5.9)
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.
Published: 2026-10-30T11:31:08.276Z
Updated: 2026-10-30T11:31:08.276Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-54939 |
vulnerable | 2026-06-08 07:33:13.813265 |
Details available
MEDIUM (5.3)
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.
Published: 2025-08-01T00:00:00.000Z
Updated: 2025-08-20T19:55:50.645Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31617 |
vulnerable | 2026-06-08 06:35:32.024801 |
Details available
OpenLiteSpeed before 1.8.1 mishandles chunked encoding.
Published: 2024-05-22T17:42:57.754Z
Updated: 2025-02-13T15:47:52.789Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40518 |
vulnerable | 2026-06-08 06:11:03.368493 |
Details available
LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.
Published: 2023-08-14T00:00:00.000Z
Updated: 2024-10-09T15:47:00.349Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0074 |
vulnerable | 2026-06-08 05:39:09.204979 |
Privilege Escalation in OpenLiteSpeed Web Server
HIGH (8.8)
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1.
Published: 2022-10-27T19:32:19.200Z
Updated: 2025-05-09T19:19:06.373Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0073 |
vulnerable | 2026-06-08 05:39:09.204363 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0072 |
vulnerable | 2026-06-08 05:39:09.202099 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5519 |
vulnerable | 2026-06-08 05:26:42.918017 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19792 |
vulnerable | 2026-06-08 05:11:16.111772 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19791 |
vulnerable | 2026-06-08 05:11:16.107612 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3890 |
vulnerable | 2026-06-08 05:06:38.711812 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.