LiteSpeed

Category: Security

Learn how LiteSpeed keeps your site secure. Protect your servers with already familiar mod_security rules while also taking advantage of a host of built-in anti-DDoS features, such as bandwidth and connection throttling.

Because LSWS’s event-driven architecture handles all connections with a single process (or a few processes), LiteSpeed is able to easily gather data about the number of connections or amount of bandwidth an IP is using. This allows the server to efficiently impose limits.

  • HTTP/2 Bomb Vulnerability

    HTTP/2 Bomb Vulnerability

    Here is what you need to know about LiteSpeed and the HTTP/2 Bomb vulnerability:

    • HTTP/2 Bomb is a remote denial-of-service exploit that exists in many servers’ default HTTP/2 configurations.
    • LiteSpeed server products (including LiteSpeed Web Server Enterprise, LiteSpeed Web ADC, and OpenLiteSpeed) are effectively not vulnerable to HTTP/2 Bomb attacks

    Who is affected by HTTP/2 Bomb?

    The HTTP/2 Bomb vulnerability was announced this week on the Calif Substack after having previously been disclosed to nginx and Apache, who then released their own patches. Other servers, not including LiteSpeed, have since been included in the “affected” list.

    LiteSpeed Web Server is an Apache drop-in replacement, but LiteSpeed does not share any code with Apache.

    LiteSpeed’s from-the-ground-up implementation of Apache-compatible systems means that LiteSpeed is usually not subject to the same vulnerabilities as Apache. That is indeed the case with the HTTP/2 Bomb vulnerability.

    How are LiteSpeed Users Protected?

    We assessed the vulnerability and concluded that there is only one situation in which LiteSpeed servers may be exploitable by the HTTP/2 Bomb vulnerability:

    • If an IP address is added to the Trusted IP list, and is intentionally allowed to abuse the server, the HTTP/2 Bomb may have an effect.

    We don’t anticipate that many admins have trusted their attacker’s IPs, but even if they have, the amplification rate is roughly 30x to 40x. This should not be enough to bring down a server.

    Just the same, we will add some tightening around this scenario in upcoming server product releases.

    If you are using LiteSpeed Web Server Enterprise, LiteSpeed Web ADC, or OpenLiteSpeed, there is nothing you need to do right now. You are already immune to this attack, assuming your Trusted IP list contains only truly trustworthy IPs.

  • Security Update for LiteSpeed cPanel Plugin

    Security Update for LiteSpeed cPanel Plugin

    LiteSpeed cPanel Plugin Vulnerability

    We have another urgent security update for LiteSpeed’s user-end plugin for cPanel.

    Last night we were made aware of a vulnerability affecting our user-end cPanel plugin (LiteSpeed’s WHM plugin was not affected). We patched this vulnerability in v2.4.8.

    Please update to the latest version of the cPanel user-end plugin, which is bundled with the WHM plugin..

    This Privilege Escalation vulnerability, which was reported to us by the team at Namecheap, has been assigned CVE-2026-54420.

    Impact

    A vulnerability in the LiteSpeed cPanel plugin allows a user with FTP or web shell access to escalate privileges to root on shared hosting servers running CloudLinux/CageFS.

    This vulnerability is being actively exploited, and poses a risk for all user-end plugin versions prior to 2.4.8.

    Use the following command to determine if your server has been affected:

    grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/null

    If there is no output, then your server has not been affected.

    If this command results in any output, the vulnerability may have been exploited on your server. There can be false positives, so look for the following to confirm:

    1. Pairing: generateEcCert immediately followed by packageUserSize for the same user (legitimate UI flows don’t chain these)
    2. Concurrency: 7–10 concurrent calls per attempt (legitimate UI does one at a time)
    3. Same source IP hammering both endpoints

    To determine any damage done, examine the system logs for any actions taken by the detected IPs. If you need assistance, you may contact our support team.

    Actions

    We urgently recommend that those using the LiteSpeed user-end plugin for cPanel upgrade to LiteSpeed WHM Plugin v5.3.2.1 (bundled w/ cPanel plugin v2.4.8) or higher to patch this vulnerability.

    To update the WHM plugin, run this command, which will also update the user-end plugin, if you currently have it installed:

    wget -O- https://litespeedtech.com/packages/cpanel/lsws_whm_plugin_install.sh | sh

    If you cannot upgrade at this time, you can use the following command to remove the user-end plugin and avoid this vulnerability:

    /usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall

    Once you’ve updated the WHM plugin, you can run the following commands, which will reinstall the user-end plugin and turn on autoinstall:

    /usr/local/lsws/admin/misc/lscmctl cpanelplugin --install
/usr/local/lsws/admin/misc/lscmctl cpanelplugin -autoinstall 1

    Timeline

    • May 31, 2026: We were alerted to the original issue.
    • May 31, 2026: cPanel pushed an uninstall command for the user-end plugin
    • Jun 1, 2026: We released cPanel plugin v2.4.8 and WHM plugin v5.3.2.1
    • Jun 1, 2026: We applied for a CVE
    • Jun 14, 2026: CVE-2026-54420 was assigned

    Conclusion

    We thank Namecheap for bringing the original issue to our attention. We’d also like to thank the cPanel team for their immediate action in preventing further exploitation on additional servers. The vulnerability has been patched, so if you are keeping your cPanel plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so immediately.

  • Security Update for LSCWP

    Security Update for LSCWP

    Security patch for LiteSpeed Cache for WordPress

    We have a security update for LiteSpeed Cache for WordPress. A few months ago, we were made aware of a vulnerability in the LiteSpeed Cache for WordPress plugin. We patched it shortly thereafter, in v7.8.

    To protect your WordPress sites, please update to the latest version of the LSCache plugin immediately.

    This cross-site scripting vulnerability, reported by the WordFence team, has been assigned CVE-2026-3375.

    Impact

    This vulnerability only affects those sites where one or both of the following settings are enabled in Page Optimization > CCS Settings:

    • Generate UCSS
    • Load CSS Asynchronously

    Additionally, the site’s server IP must be exposed, and there must be a QUIC.cloud- or Cloudflare-related misconfiguration in the site’s WordPress code.

    With all of the above in place, the vulnerability may be exploited.

    Given that it requires a misconfiguration, we don’t expect this vulnerability to be frequently exploited.

    Actions

    We recommend that every site upgrade to the plugin version 7.8 or higher to patch this vulnerability.

    Timeline

    • February 27, 2026: WordFence alerted us to the issue.
    • March 3, 2026: We patched the issue and released v7.8 to the WordPress repository
    • March 20, 2026: We added v7.8 to the list of stable releases in our control panel plugins

    Conclusion

    We thank WordFence for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.

  • Security Update for LiteSpeed cPanel Plugin

    Security Update for LiteSpeed cPanel Plugin

    LiteSpeed cPanel Plugin Vulnerability

    We have an urgent security update for LiteSpeed’s user-end plugin for cPanel.

    This week we were made aware of a vulnerability affecting our user-end cPanel plugin (LiteSpeed’s WHM plugin was not affected). We patched this vulnerability in v2.4.5.

    Please update to the latest version of the cPanel user-end plugin, which is bundled with the WHM plugin..

    This Privilege Escalation vulnerability, which was reported to us by David Strydom has been assigned CVE-2026-48172.

    Impact

    Any cPanel user (including an attacker or a compromised account) may exploit the lsws.redisAble function to execute arbitrary scripts as root.

    This vulnerability is being actively exploited, and poses a risk for all user-end plugin versions between v2.3 and v2.4.4.

    Use the following command to determine if your server has been affected:

    grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null

    If there is no output, then your server has not been affected.

    If this command results in any output, we recommend you examine the IPs in the list, determine if they are valid, and if not, block them. To determine any damage done, examine the system logs for any actions taken by the detected IPs. If you need assistance, you may contact our support team.

    Actions

    We urgently recommend that those using the LiteSpeed user-end plugin for cPanel upgrade to LiteSpeed WHM Plugin v5.3.1.0 (bundled w/ cPanel plugin v2.4.7) or higher to patch this vulnerability.

    If you cannot upgrade at this time, you can use the following command to remove the user-end plugin and avoid this vulnerability:

    /usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall

    Additional Vulnerabilities

    After addressing the initial report, we undertook a full security review of our cPanel and WHM plugins

    As a result, we have patched additional potential attack vectors in both plugins and released cPanel plugin v2.4.7 bundled with WHM plugin v5.3.1.0.

    To be clear, there have been no reports of these additional vulnerabilities being exploited. This was a proactive review, undertaken with the assistance of the cPanel/WebPros team.

    Timeline

    • May 19, 2026: We were alerted to the original issue.
    • May 19, 2026: cPanel pushed an uninstall command for the user-end plugin
    • May 19, 2026: We released cPanel plugin v2.4.6 and WHM plugin v5.3.0.0
    • May 20, 2026: We applied for a CVE
    • May 21, 2026: We completed a security review and released v2.4.7 and v5.3.1.0 of the plugins

    Conclusion

    We thank David Strydom for bringing the original issue to our attention. We’d also like to thank the cPanel team for their immediate action in preventing further exploitation on additional servers. All known vulnerabilities have been patched, so if you are keeping your cPanel plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so immediately.

  • Security Update for LSCWP

    Security Update for LSCWP

    Security patch for LiteSpeed Cache for WordPress

    We have a security update for LiteSpeed Cache for WordPress. Recently we were made aware of a vulnerability in the LiteSpeed Cache for WordPress plugin. We patched this vulnerability earlier this month, in v7.6.

    To protect your WordPress sites, please update to the latest version of the LSCache plugin immediately.

    This cross-site scripting vulnerability, reported by the Trustwave team, has been assigned CVE-2025-12450.

    Impact

    This vulnerability only affects those who have debug enabled:

    • Debug Log must be ON or Admin IP Only
    • Enable Cache must be ON

    With both of these settings in place, the vulnerability may be exploited when a visitor accesses a link with a particular malicious string appended to the URL.

    Since it’s not common to turn on debug mode and keep it on, we don’t expect this vulnerability to be frequently exploited.

    Actions

    We recommend that every site upgrade to the plugin version 7.6 or higher to patch this vulnerability.

    Timeline

    • October 14, 2025: Trustwave alerted us to the issue.
    • October 15, 2025: We patched the issue and released v7.6 to the WordPress repository
    • October 21, 2025: We added v7.6 to the list of stable releases in our control panel plugins

    Conclusion

    We thank Trustwave for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.

  • LiteSpeed Security Update

    LiteSpeed Security Update

    LiteSpeed Security Update

    We have a security update for LiteSpeed’s QUIC and HTTP/3 Library (LSQUIC), and all three LiteSpeed server products. Recently we were made aware of a vulnerability affecting LSQUIC. We patched this vulnerability in v4.3.1.

    Please update to the latest versions of LSQUIC and all LiteSpeed server products.

    This Allocation of Resources Without Limits or Throttling vulnerability, reported by Yohann Sillam from Imperva Offensive Team, has been assigned CVE-2025-54939.

    Impact

    UDP packets, crafted in a particular way and sent to the HTTP/QUIC service port, can cause an unbounded memory leak. This has the potential to cause the process or the server to run out of memory, eventually leading to a Denial of Service.

    This vulnerability in the LSQUIC Library affects all server products and may be easily exploited.

    Actions

    We strongly recommend that those using the QUIC and HTTP/3 library upgrade to LSQUIC version 4.3.1 or higher to patch this vulnerability.

    Additionally, those who are using LiteSpeed server products, should upgrade to the following versions of these products immediately:

    • LiteSpeed Web Server (LSWS) v6.3.4 or higher
    • LiteSpeed Web ADC (LSADC) v3.3.1 or higher
    • OpenLiteSpeed (OLS) v1.8.4 or higher

    If you cannot upgrade your server at this time, you can disable HTTP/3 to avoid this vulnerability.

    Timeline

    • July 15, 2025: We were alerted to the issue.
    • July 18, 2025: Patch was added to our internal repo to be included in all subsequent builds of our commercial server products
    • August 1, 2025: Released LSWS v6.3.4 and OLS v1.8.4
    • August 4, 2025: Released LSADC v3.3.1
    • August 13, 2025: Released LSQUIC v4.3.1 to the GitHub repository

    Conclusion

    We thank Imperva Offensive Team for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LSQUIC library or your LiteSpeed server products up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.

  • LiteSpeed Not Affected By MadeYouReset

    LiteSpeed Not Affected By MadeYouReset

    LiteSpeed Not Vulnerable to MadeYouReset HTTP/2 Attack

    Here is what you need to know about LiteSpeed and the HTTP/2 MadeYouReset vulnerability, specifically CVE-2025-8671:

    • MadeYouReset uses malformed HTTP/2 control frames in order to break the maximum concurrent streams limit.
    • LiteSpeed server products (including LiteSpeed Web Server Enterprise, LiteSpeed Web ADC, and OpenLiteSpeed) are NOT vulnerable to MadeYouReset attacks

    What is MadeYouReset?

    The MadeYouReset vulnerability was announced today as Vulnerability Note #767506 published by the CERT Coordination Center.

    The note states:

    By opening streams and then rapidly triggering the server to reset them using malformed frames or flow control errors, an attacker can exploit a discrepancy created between HTTP/2 streams accounting and the servers active HTTP requests. Streams reset by the server are considered closed, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent HTTP/2 requests on a single connection.

    How are LiteSpeed Users Protected?

    We simulated a MadeYouReset attack, and our LiteSpeed servers quickly blocked it due to the aggressiveness of the HTTP/2 behavior. Before blocking the client, LiteSpeed’s memory usage was not affected. This is mainly because of LiteSpeed’s efficient stream life cycle and memory management. Resources are promptly released when streams are reset, even in cases where a quick blocking is not triggered.

    We are confident that MadeYouReset attacks cannot cause any trouble with LiteSpeed’s HTTP/2 implementation.

    If you are using LiteSpeed Web Server Enterprise, LiteSpeed Web ADC, or OpenLiteSpeed, there is nothing you need to do. You are already immune to this attack.

  • LSCWP Responsive Placeholders Patch

    LSCWP Responsive Placeholders Patch

    LiteSpeed Cache v7.1 Patch

    We have a security update for LiteSpeed Cache for WordPress. Recently we were made aware of a vulnerability in the LiteSpeed Cache for WordPress plugin. We patched this vulnerability in v7.1.

    To protect your WordPress sites, please update to the latest version of the LSCache plugin immediately.

    This Server Side Request Forgery vulnerability, reported by the Patchstack team, has been assigned CVE-2025-47437.

    Impact

    This vulnerability affects those using Responsive Placeholders, and having the following configuration:

    • Media Settings > Lazy Load Images must be ON
    • Media Settings > Responsive Placeholders must be ON

    With both of these settings in place, the vulnerability may be exploited by a user with unfiltered_html capability and the ability to create a new post with a Custom HTML block.

    NOTE: by default, only Editor, Admin, and Super Admin roles have the unfiltered_html capability, but admins may assign it to other roles on a case-by-case basis via a plugin or custom code.

    Actions

    We suggest that every site upgrade to the plugin version 7.1 or higher to patch this low-severity vulnerability.

    Timeline

    • April 10, 2025: Patchstack alerted us to the issue.
    • April 24, 2025: We patched the issue and released v7.1 to the WordPress repository.
    • April 30, 2025: We added v7.1 to the list of stable releases in our control panel plugins.

    Conclusion

    We thank Patchstack for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.

  • LSQUIC Security Update

    LSQUIC Security Update

    We have a security update for LiteSpeed’s QUIC and HTTP/3 Library (LSQUIC). Recently we were made aware of a vulnerability affecting several QUIC implementations, including LSQUIC. We patched this vulnerability in v4.2.0.

    Please update to the latest version of LSQUIC.

    This Hash-based Denial-of-Service vulnerability, reported by Paul Bottinelli, Cryptography and Security Consultant at NCC Group, has been assigned CVE-2025-24947.

    Impact

    Several QUIC implementations, including LSQUIC, use a hash table to store Secure Connection IDs (or, SCIDs) as indices to connection data. If the hash function is weak, an attacker can trigger a denial-of-service attack by initiating connections with colliding SCIDs, causing significant slow downs.

    LSQUIC, while technically vulnerable to this type of attack, has a rate limiting feature. If there are too many INIT packets for new connections, a Retry packet will be triggered. This means, LSQUIC doesn’t put the client-generated SCID in the hash. As such, in a real-world deployment, this vulnerability is not easy to exploit with LSQUIC.

    Previously, we used XXH32(), which is prone to hash collisions, to generate a 32-bit hash key. With v4.2.0, LSQUIC has switched to rapidhash, which allows us to generate a stronger random seed, and produces a 64-bit hash key.

    Our test shows that it addresses the hash collision issue well. Here are some examples:

    without seed 
211C6C858BB29CDD408F1EBDAA43A980CE016B71 -> F3C569EBDE612455
211CEC85DBB29CDE418F1EBDAA43A980CF214B71 -> F3C569EBDE612455
with seed 
211C6C858BB29CDD408F1EBDAA43A980CE016B71 -> 3173D06C62EB64E2
211CEC85DBB29CDE418F1EBDAA43A980CF214B71 -> EF06763606005C05
without seed 
211C6C858BB29CDD408F1EBDAA43A980CE016B71 -> 56B71185739E534A
211CEC85DBB29CDE418F1EBDAA43A980CF214B71 -> 56B71185739E534A
with seed 
211C6C858BB29CDD408F1EBDAA43A980CE016B71 -> D18323CAAFD14A5A
211CEC85DBB29CDE418F1EBDAA43A980CF214B71 -> 190C4F2674528BE1
without seed 
211C6C858BB29CDD408F1EBDAA43A980CE016B71 -> 9183B84F3AE05847
211CEC85DBB29CDE418F1EBDAA43A980CF214B71 -> 9183B84F3AE05847
with seed 
211C6C858BB29CDD408F1EBDAA43A980CE016B71 -> D05A92D1069111F3
211CEC85DBB29CDE418F1EBDAA43A980CF214B71 -> 3150BF22FFAA28E4

    Actions

    We recommend that those using the QUIC and HTTP/3 library upgrade to LSQUIC version 4.2.0 or higher to patch this vulnerability.

    Those who are using LiteSpeed server products, including LiteSpeed Web Server (LSWS), LiteSpeed Web ADC (LSADC), and OpenLiteSpeed (OLS), should upgrade to the latest versions of these products.

    Timeline

    • January 10, 2025: We were alerted to the issue.
    • January 15, 2025: Patch was added to our internal repo to be included in all subsequent builds of our commercial server products
    • February 18, 2025: Released LSWS v 6.3.2, LSADC v3.3.0, and OLS v1.8.3
    • February 18, 2025: Released LSQUIC v4.2.0 to the GitHub repository

    Conclusion

    We thank Paul Bottinelli for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LSQUIC library or your LiteSpeed server products up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.

  • LSCWP Viewport Images Patch

    LSCWP Viewport Images Patch

    Introduction

    We have a security update for LiteSpeed Cache for WordPress. Recently we were made aware of a vulnerability in the LiteSpeed Cache for WordPress plugin. We patched this vulnerability in v6.5.3.

    To protect your WordPress sites, please update to the latest version of the LSCache plugin immediately.

    This Cross Site Scripting vulnerability, reported by the Patchstack team, has been assigned CVE-2024-51915.

    Impact

    This vulnerability affects those using the Viewport Images service, and having the following Page Optimization configuration:

    • Media Settings > Lazy Load Images must be ON
    • VPI > Viewport Images must be ON
    • Tuning > Optimize for Guests Only must be OFF

    With all of these settings in place, the vulnerability may be exploited by a user with the Editor role. They must have permission to create a new post and set the LiteSpeed Options on that post, before they can inject JavaScript code through a DOM mutation.

    Actions

    We strongly recommend that every site upgrade to the plugin version 6.5.3 or higher to patch this vulnerability.

    Timeline

    • November 07, 2024: Patchstack alerted us to the issue.
    • December 04, 2024: We patched the issue and released v6.5.3 to the WordPress repository
    • December 05, 2024: We added v6.5.3 to the list of stable releases in our control panel plugins

    Conclusion

    We thank Patchstack for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.