Security Advisory: LiteSpeed Web Server HTTP/2 Request Smuggling

Improper header validation on the HTTP/2 stream permits request smuggling against proxied backends, enabling cache poisoning on shared hosting configurations.

High 2026-05-05

LiteSpeed AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9

Affected Versions

LiteSpeed Web Server 6.2.5 and earlier

Patched Version

LiteSpeed Web Server 6.2.6

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

dnf update lsws
/usr/local/lsws/bin/lshttpd -r

AlmaLinux 8 / CloudLinux 8

dnf update lsws
/usr/local/lsws/bin/lshttpd -r

CentOS 7 / CloudLinux 7

yum update lsws
/usr/local/lsws/bin/lshttpd -r

References

Vendor Advisory

Security Advisories

Related Advisories

LiteSpeed CVE-2026-15345: The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is

2026-09-08

LiteSpeed CVE-2026-18978: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment

2026-09-08

LiteSpeed CVE-2026-3129: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted

2026-09-08

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System