CVE-2025-54939

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-01 · updated 2026-06-17
Weakness: CWE-770

Description

LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

Affected products

litespeedtech Litespeed Web Adc: before 3.3.1 — fixed in 3.3.1
LiteSpeed Technologies LiteSpeed Web Server: before 6.3.4 — fixed in 6.3.4
litespeedtech LSQUIC: before 4.3.1 — fixed in 4.3.1
LiteSpeed Technologies OpenLiteSpeed: before 1.8.4 — fixed in 1.8.4

How to fix

Upgrade to a fixed version: litespeedtech Litespeed Web Adc 3.3.1; LiteSpeed Technologies LiteSpeed Web Server 6.3.4; litespeedtech LSQUIC 4.3.1; LiteSpeed Technologies OpenLiteSpeed 1.8.4. Check the vendor advisory for mitigations.

References

https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/
https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3
https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23
https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation/

Get alerted when CVE-2025-54939 or the next vulnerability affects your stack