CVE-2024-25678: Litespeedtech lsquic vulnerability

Litespeedtech · Lsquic

In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.

9.8 CVSS 3.1 Critical EPSS 0.35% · top 73.5% CWE-354 · CWE-354

9.8CVSS 3.1 base score

0.35%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Lsquic Litespeedtech

References

Link	Tags
https://github.com/litespeedtech/lsquic/commit/515f453556c99d27c4dddb5424898dc1a5537708	Patch
https://github.com/litespeedtech/lsquic/releases/tag/v4.0.4	Release Notes
https://www.rfc-editor.org/rfc/rfc9001	Not Applicable
https://github.com/litespeedtech/lsquic/commit/515f453556c99d27c4dddb5424898dc1a5537708	Patch
https://github.com/litespeedtech/lsquic/releases/tag/v4.0.4	Release Notes
https://www.rfc-editor.org/rfc/rfc9001	Not Applicable

Track CVE-2024-25678 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-30592Litespeedtech lsquic null pointer dereference vulnerabilityliblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.EPSS 3.2%11 May 2022 7.5CVE-2025-54939Litespeedtech litespeed web adc allocation without limits vulnerabilityLiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.EPSS 0.81%1 Aug 2025

Source: NIST National Vulnerability Database (record CVE-2024-25678), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.