Skip to content
OpenAdvisories

Product · litespeedtech

openlitespeed

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-119559

    OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

    OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that alway…

    litespeedtech openlitespeed
  • Medium 6.7
    CVE-2026-104474

    OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update

    OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/lo…

    litespeedtech openlitespeed