LiteSpeed LSQUIC HTTP/3 critical flaw: update to 6.3.7 build 8

LiteSpeed has shipped a fix for a critical vulnerability in LSQUIC, the QUIC and HTTP/3 library built into LiteSpeed Web Server Enterprise, OpenLiteSpeed, and LiteSpeed Web ADC. The flaw is remotely exploitable without authentication, and LiteSpeed rates it 9.2 (critical), with remote code execution as the worst case. Only servers with HTTP/3 enabled are exposed, but HTTP/3 has been on by default in LSWS Enterprise since 6.0, so assume every LiteSpeed host in your fleet is affected until you check.

LiteSpeed released the patched builds on 3 November 2026 and is holding the fix back from the public LSQUIC repository until 16 November 2026. After that date the patch diff is public and unpatched servers become far easier targets. That is your deadline.

Fixed versions

The public LSWS changelog lists 6.3.7 build 8 as "Address a critical LSQUIC vulnerability". A CVE has been requested but not yet published. Earlier 6.3.7 builds, including build 2 from the September lscgid fix and build 7 from late October, are not patched for this issue.

Check and update LSWS Enterprise

/usr/local/lsws/bin/lshttpd -v
cat /usr/local/lsws/BUILD

To force the latest 6.3.7 build and restart:

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
/usr/local/lsws/bin/lswsctrl restart
cat /usr/local/lsws/BUILD

If BUILD still reports 7 or lower, the new package has not reached your update mirror yet. Retry, or open a ticket with LiteSpeed; do not mark the host as patched.

Build 8 also restores the alt-php44 and alt-php51 handlers removed in build 7, so servers running CloudLinux legacy PHP versions get those back as a side effect.

For OpenLiteSpeed, update through your package manager to 1.9.4 or later. For Web ADC, upgrade to 3.4.1; the public ADC changelog had not been updated at the time of writing, so confirm the running version after the upgrade. If you are weighing which edition to run going forward, see LiteSpeed Enterprise vs OpenLiteSpeed.

Stopgap: turn HTTP/3 off

If you cannot patch today, disabling HTTP/3 closes the exposure. Browsers fall back to HTTP/2 or HTTP/1.1 with no visible breakage. On cPanel, add this to /etc/apache2/conf.d/includes/pre_main_global.conf:

<IfModule LiteSpeed>
  QuicEnable off
</IfModule>

Then rebuild and restart:

/usr/local/cpanel/scripts/rebuildhttpdconf
/usr/local/lsws/bin/lswsctrl restart

A blunter, panel-agnostic option is to drop inbound UDP 443, since QUIC never reaches LSWS without it. With CSF, remove 443 from UDP_IN in /etc/csf/csf.conf and run csf -r. Our CSF install guide covers where those settings live.

Reverse whichever change you made once the server runs a fixed build, then confirm HTTP/3 works again with the checks in our HTTP/3 and QUIC setup guide.

After patching

• Confirm the build on every node, not just one per cluster.
• Check /usr/local/lsws/logs/error.log for startup errors after the restart.
• Verify HTTP/3 is back: netstat -lupn | grep 443 should show LSWS on UDP 443.
• Load balancers count: if you front backends with LiteSpeed Web ADC, it terminates QUIC itself and needs its own upgrade.

LiteSpeed's notice also covers a separate critical flaw in the LiteSpeed Cache module for PrestaShop, fixed in module 1.6.2 (released 30 October 2026). It is unrelated to LSQUIC and only matters if you or your customers run PrestaShop with that module.

Sources

• LiteSpeed Web Server changelog
• LiteSpeed QUIC/HTTP3 on cPanel documentation
• OpenLiteSpeed releases
• LiteSpeed Technologies security advisory emailed 4 November 2026: "LiteSpeed security advisory: LSQUIC and LiteSpeed Cache for PrestaShop"

Next steps

• Buy or renew a LiteSpeed Enterprise license
• LiteSpeed Enterprise 6.3.7 build 2 security update
• Fix LiteSpeed license errors after an upgrade