LiteSpeed Patches Critical HTTP/3 Flaw Ahead of November 16 Disclosure

LiteSpeed has patched a critical flaw in LSQUIC, the HTTP/3 library in its server software, and is urging customers to update immediately. It plans to disclose the flaw publicly on November 16. Servers on LiteSpeed Enterprise 6.3.x need 6.3.7 build 8, released on November 3, so the version number alone does not show whether a server is protected.

A customer notice from LiteSpeed, posted by users on the Enhance and DirectAdmin forums on November 4, gives the flaw a CVSS score of 9.2. The flaw can be exploited remotely and without authentication on servers with HTTP/3 enabled. On LiteSpeed Enterprise that is the default, given HTTPS with a trusted certificate and an open UDP port 443. The possible effects include a crash or information disclosure and, in the worst case, remote code execution. The notice does not mention any attacks, and a CVE ID has been requested.

LiteSpeed is holding the fix back from the public LSQUIC repository until the disclosure date to give customers time to update, and the notice requests that details of the flaw not be shared publicly before then. This report leaves out the technical details. Anyone building LSQUIC from source can contact LiteSpeed for early access.

Which Versions Carry the Fix

LiteSpeed lists these fixed versions, or later:

LiteSpeed’s changelog shows both Enterprise builds released on November 3, with the entry “Address a critical LSQUIC vulnerability.” The installed build number is in /usr/local/lsws/BUILD. To install the latest build of 6.3.7, run /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7.

LiteSpeed’s documentation notes that notifications “are not sent for new builds of the same version number.” Forcing a version with that command also stops a plain lsup.sh cron job from following the stable tier, until the follow_stable marker is restored with touch /usr/local/lsws/autoupdate/follow_stable. LiteSpeed also requests a check, after the update, that the new version is running and that HTTP/3 connections work.

OpenLiteSpeed 1.9.4 Predates the Notice

The notice identifies OpenLiteSpeed 1.9.4 as fixed, although that version predates the notice. LiteSpeed published it on GitHub on October 24, and neither the release notes nor the October 26 forum announcement mention LSQUIC. Administrators who cannot confirm whether their installed package includes the fix can contact LiteSpeed or temporarily disable HTTP/3.

OpenLiteSpeed’s documentation directs DirectAdmin users to a separate update procedure, and on November 4 an administrator of the DirectAdmin forum announced a new panel build that “bumps LiteSpeed and OpenLiteSpeed versions.”

Turning Off HTTP/3 as a Stopgap

For servers that cannot update right away, LiteSpeed offers one interim step: disable HTTP/3, and clients fall back to HTTP/2 or HTTP/1.1. It still strongly recommends upgrading.

According to LiteSpeed’s Enterprise documentation, HTTP/3 can be switched off at the server, listener or virtual host level, and once it is off at one level, more specific levels cannot turn it back on. The server-level setting is “Enable HTTP3/QUIC” in the tuning configuration, and the listener-level one is “Open HTTP3/QUIC (UDP) port.”

On cPanel servers with EasyApache 4, the server-level method is to add these lines to /etc/apache2/conf.d/includes/pre_main_global.conf:

<IfModule LiteSpeed>
 QuicEnable off
</IfModule>

Next, run /usr/local/cpanel/scripts/rebuildhttpdconf, then restart LiteSpeed.

A Separate Critical Fix for PrestaShop Stores

The same notice covers a separate critical vulnerability in the LiteSpeed Cache module for PrestaShop, affecting module versions before 1.6.2. LiteSpeed fixed it in version 1.6.2, released on October 30 as an urgent security update. According to the notice, an unauthenticated attacker could send crafted requests that potentially give full control of the store and access to customer and payment data. A CVE is forthcoming. For stores that may have been exposed, LiteSpeed also recommends reviewing administrator accounts and installed modules and rotating the database and other credentials stored in the site configuration.