high7.5
CVE-2026-115482
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstra…
Impact
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
Affected products
| Product | Affected versions |
|---|---|
| Lsquic | before 4.9.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.