LiteSpeed 6.3.7 Build 8: Critical LSQUIC HTTP/3 Vulnerability — Patch Before November 16

TL;DR: LiteSpeed Web Server Enterprise 6.3.7 Build 8 (released November 3, 2026) fixes a critical vulnerability in LSQUIC — the QUIC/HTTP/3 library built into the server. A CVE has been requested but not yet assigned, and full disclosure is planned for November 16, 2026. Both LiteSpeed Enterprise and OpenLiteSpeed use LSQUIC; if you serve HTTP/3, upgrade to Build 8 immediately.

LiteSpeed Technologies released Web Server Enterprise 6.3.7 Build 8 on November 3, 2026 with a one-line security entry: “Address a critical LSQUIC vulnerability.” LSQUIC is LiteSpeed’s open-source implementation of the QUIC and HTTP/3 protocols — the transport that serves your sites’ HTTP/3 traffic. A critical flaw in that library is reachable by anyone who can open an HTTP/3 connection to your server, which on HTTP/3-enabled hosts is the public internet.

A CVE has been requested but not yet assigned, and LiteSpeed is reportedly planning full disclosure on November 16, 2026 — meaning the technical details of the flaw will become public then, and unpatched servers will become primary targets. The same LSQUIC library is used in OpenLiteSpeed, so OLS users are affected by the same underlying flaw and should apply the equivalent OpenLiteSpeed build.

What Is LSQUIC and Why Does This Matter?

LSQUIC is the QUIC/HTTP/3 engine embedded in LiteSpeed Web Server Enterprise and OpenLiteSpeed. HTTP/3 is enabled by default on most modern LiteSpeed installs — every site served over HTTP/3 negotiates traffic through LSQUIC. A critical vulnerability in that library is reachable remotely by crafted QUIC packets, without authentication, before any application code runs.

This is also the second LSQUIC-focused advisory from LiteSpeed this quarter: our November 5 advisory covered the LSQUIC and LiteSpeed Cache for PrestaShop disclosures, and the April 2026 cycle fixed “remote exploit vulnerabilities in the HTTP/3 engine” in 6.3.5. The QUIC implementation is clearly under active attack research.

Are You Affected?

• LiteSpeed Web Server Enterprise installs on builds before 6.3.7 Build 8 with HTTP/3 (QUIC) enabled — yes.
• OpenLiteSpeed installs — yes, the same LSQUIC library is used; apply the equivalent OpenLiteSpeed build when available.
• Servers with HTTP/3 disabled — the LSQUIC listener is not active, materially reducing exposure, but updating is still recommended.

Verify your current build in WebAdmin → Service Status (or lshttpd -V on the command line). If your build string ends in a number lower than 8 on the 6.3.7 line, you are on an affected build.

How to Patch

1. Update LiteSpeed: via WebAdmin → Server → Actions → Version Manager → “Latest” (6.3.7 Build 8), or /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7 on the CLI.
2. Restart the server: grace restart is sufficient — the LSQUIC listener reloads with the process.
3. Confirm the build: the version string should report 6.3.7 Build 8. Then re-test HTTP/3 on a site to confirm QUIC still negotiates cleanly.

Interim Guidance Until You Patch

• Disabling HTTP/3 removes the LSQUIC attack surface entirely (WebAdmin → Listeners → QUIC), at the cost of HTTP/3 performance for visitors whose browsers support it.
• Rate-limiting UDP/443 at the firewall blunts flood-based exploitation attempts but does not stop a targeted crafted-packet attack.
• LiteSpeed reports a few ModSecurity corner cases also fixed in Build 8 — if you run ModSecurity with LiteSpeed, another reason to take the update.

Frequently Asked Questions

Is there a CVE for the LSQUIC vulnerability?

A CVE has been requested but not yet assigned as of the release. LiteSpeed plans full technical disclosure on November 16, 2026 — after that date the flaw details will be public knowledge, which is the hard deadline for unpatched servers.

Does OpenLiteSpeed need the same update?

OpenLiteSpeed uses the same LSQUIC library, so the underlying flaw applies. LiteSpeed releases OLS builds separately — install the latest OpenLiteSpeed build that incorporates the patched LSQUIC, and check the OpenLiteSpeed release notes for the build number.

Was this flaw exploited before the patch?

LiteSpeed has not attributed the vulnerability to in-the-wild exploitation in the available announcements. However, the severity rating is Critical, disclosure is planned for November 16, and the patch has been available since November 3 — patching before the 16th keeps you ahead of the disclosure.

How do I verify HTTP/3 still works after the update?

Test a hosted domain with an HTTP/3 checker (curl –http3, or an online QUIC test) and confirm the response arrives over HTTP/3 with the alt-svc advertisement intact. Then confirm the build number in WebAdmin matches 6.3.7 Build 8.

Conclusion

Build 8 closes a Critical flaw in the HTTP/3 engine of one of the most widely deployed commercial web servers, with disclosure coming November 16. If you serve HTTP/3 through LiteSpeed Enterprise or OpenLiteSpeed, this is a patch-now advisory: upgrade to LiteSpeed 6.3.7 Build 8, restart, verify the build, and keep HTTP/3 enabled. If you license LiteSpeed through us, the license is unchanged by the update — see our LiteSpeed license page, and our November 5 LSQUIC advisory for the related PrestaShop cache disclosure.

Sources: LiteSpeed Technologies changelog (docs.litespeedtech.com/lsws/changelog), webhosting.today coverage of the November 5 announcement.