PT-2025-31606 · Litespeed · Litespeed Quic

Yohann Sillam · Published 2025-08-01 · Updated 2025-08-27 · CVE-2025-54939

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LiteSpeed QUIC (LSQUIC) Library versions prior to 4.3.1

Description The LiteSpeed QUIC (LSQUIC) Library contains a memory leak in the lsquic engine packet in function.

Recommendations Update to LiteSpeed QUIC (LSQUIC) Library version 4.3.1 or later.

Exploit

Fix

DoS

Memory Leak

Allocation of Resources Without Limits

Weakness Enumeration

CWE-401

CWE-770

Related Identifiers

CVE-2025-54939

Affected Products

Litespeed Quic

References · 16

• 🔥 https://imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54939 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54939 · Vendor Advisory
• https://blog.litespeedtech.com/2025/08/18/litespeed-security-update · Vendor Advisory
• https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23 · Note
• https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3 · Note
• https://twitter.com/RonMasas/status/1957695496606158937 · Twitter Post
• https://twitter.com/dailytechonx/status/1958642768965759215 · Twitter Post
• https://t.me/cveNotify/133703 · Telegram Post
• https://t.me/cveNotify/133711 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1951186057652842983 · Twitter Post
• https://twitter.com/RigneySec/status/1957641064615145504 · Twitter Post
• https://twitter.com/omvapt/status/1958419305508241832 · Twitter Post
• https://twitter.com/CVEnew/status/1951159668052570385 · Twitter Post
• https://twitter.com/Dinosn/status/1958377013883846857 · Twitter Post