CVE-2026-115482: CWE-770 Allocation of Resources Without Limits or Throttling in litespeedtech lsquic

The vulnerability identified as CVE-2026-115482 affects lsquic versions prior to 4.9.0. It involves the HTTP/3 implementation's failure to impose limits on the number of buffered header sets, which can be exploited to cause excessive memory usage. This is linked to the QPACK header compression mechanism, specifically involving header_out_dynamic_entry and es_max_header_list_size parameters. The issue is classified under CWE-770, indicating allocation of resources without limits or throttling. The CVSS v3.1 score is 7.5, reflecting a high impact on availability due to potential memory exhaustion. No known exploits in the wild have been reported, and no patch links are provided in the data.

The vulnerability can cause denial of service conditions by exhausting memory resources on affected systems through unbounded buffering of HTTP/3 header sets. This impacts availability (A) without affecting confidentiality (C) or integrity (I).

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure to untrusted HTTP/3 traffic or applying resource usage controls if possible.