Critical LiteSpeed HTTP/3 Security Vulnerability
GOZEN HOST Patched All Affected Servers Within One Hour
Status: Resolved - Security Updates Applied
Date: November 4, 2026
On November 3, 2026, LiteSpeed Technologies released an emergency security update addressing a critical vulnerability in LSQUIC, the library responsible for QUIC and HTTP/3 functionality in LiteSpeed Web Server, OpenLiteSpeed, and LiteSpeed Web ADC.
The vulnerability, rated Critical (CVSS 9.2), could potentially allow unauthenticated remote attackers to cause service crashes, disclose information, or, under certain conditions, execute arbitrary code on affected servers.
The vulnerability affects installations with HTTP/3 enabled.
GOZEN HOST Response
Our infrastructure team successfully deployed the security updates across all affected GOZEN HOST-managed servers within one hour of the vendor releasing the fix.
Our immediate response reflects our commitment to maintaining secure, reliable hosting environments and protecting the infrastructure entrusted to us.
Security advisories and critical software updates are continuously monitored as part of our infrastructure management and maintenance procedures.
What This Means for Our Customers
- Security updates completed: All affected GOZEN HOST-managed LiteSpeed servers have been patched.
- No customer action required: Customers using our managed hosting environments do not need to take any action regarding this server-level vulnerability.
- Self-managed servers: Customers operating self-managed VPS or dedicated servers with LiteSpeed or OpenLiteSpeed should verify that the appropriate security updates have been installed.
Security Advisory Details
LiteSpeed has released the following corrected LiteSpeed Web Server Enterprise builds:
- LiteSpeed Web Server 6.3.7 Build 8
- LiteSpeed Web Server 6.4 RC2 Build 6
Both were released on November 3, 2026.
The vendor has scheduled additional public disclosure of the vulnerability for November 16, 2026.
For technical information and release details, please refer to:
—
GOZEN HOST Infrastructure & Security Team
Proactive monitoring. Rapid response. Infrastructure security.
