Back to Security Advisories

Security Advisory: LiteSpeed Web Server HTTP/2 Request Smuggling

An HTTP/2 request smuggling vulnerability in LiteSpeed Web Server is fixed in this security release: conflicting interpretations of H2 traffic between front end and back end can poison caches or bypass front-end access rules. Update LiteSpeed Web Server to the current build.

High
LiteSpeed AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9

Affected Versions

LiteSpeed Web Server 6.2.5 and earlier

Patched Version

LiteSpeed Web Server 6.2.6

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

dnf update lsws
/usr/local/lsws/bin/lshttpd -r

AlmaLinux 8 / CloudLinux 8

dnf update lsws
/usr/local/lsws/bin/lshttpd -r

CentOS 7 / CloudLinux 7

yum update lsws
/usr/local/lsws/bin/lshttpd -r

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in LiteSpeed software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

Request smuggling exploits a disagreement about where one HTTP request ends and the next begins. Over HTTP/2, crafted traffic to LiteSpeed Web Server could desynchronize the front-end view from what the back end receives — letting an attacker smuggle a second request past access controls, poison caches with attacker-chosen responses, or reach routes that were never meant to be exposed.

Who is affected

LiteSpeed Web Server (Enterprise) deployments serving HTTP/2 — the default for modern setups. Sites behind LiteSpeed with caching or front-end access rules are the sensitive cases.

How to apply the fix

  • Update to the current release through the WebAdmin console or the server’s update channel.
  • After updating, spot-check cached responses for anomalies.

For SharedLicense customers

Your LiteSpeed license is unaffected — this is web-server software. Update through your normal LiteSpeed channel; the license carries over.

Frequently Asked Questions

What can request smuggling actually do?
Sneak a second request past front-end controls, poison caches, or reach internal routes — all without valid access.
Which servers are exposed?
LiteSpeed Web Server deployments serving HTTP/2 traffic, especially with caching enabled.
How do I update LiteSpeed?
Use the WebAdmin console update or your package channel, then verify the running build version.

References

Security Advisories

Related Advisories

LiteSpeed 6.3.7 Build 8: Critical LSQUIC HTTP/3 Vulnerability — Patch Before November 16

2026-11-11

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System