What’s Vulnerable › Vulnerabilities

CVE-2018-19791

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-12-03 · updated 2026-06-17
• Weakness: CWE-20

Description

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.

Affected products

• LiteSpeed Technologies OpenLiteSpeed: before 1.5.0; 1.5.0, 1.5.0-rc1, 1.5.0-rc2, 1.5.0-rc3, 1.5.0-rc4, 1.5.0-rc5 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: LiteSpeed Technologies OpenLiteSpeed 1.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/litespeedtech/openlitespeed/issues/117
• https://github.com/litespeedtech/openlitespeed/issues/117

Get alerted when CVE-2018-19791 or the next vulnerability affects your stack