CVE-2025-54939

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54939
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/
https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3
https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23
https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation/
Configurations

No configuration.

History

20 Aug 2025, 20:15

Type Values Removed Values Added
References
  • () https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/ -

19 Aug 2025, 03:15

Type Values Removed Values Added
References
  • () https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation/ -

04 Aug 2025, 15:06

Type Values Removed Values Added
Summary
  • (es) La librería LiteSpeed QUIC (LSQUIC) anterior a 4.3.1 tiene una pérdida de memoria lsquic_engine_packet_in.

01 Aug 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-01 06:15

Updated : 2025-08-20 20:15

NVD link : CVE-2025-54939

Mitre link : CVE-2025-54939

CVE.ORG link : CVE-2025-54939

JSON object : View

Products Affected

No product.

CWE
CWE-770

Allocation of Resources Without Limits or Throttling