+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityHostingcPanelLiteSpeed

LiteSpeed 6.3.7 Build 8: Critical LSQUIC - Check BUILD, Not 6.3.7

By ServerGurus Team7 November 20267 min read
LiteSpeed 6.3.7 Build 8: Critical LSQUIC - Check BUILD, Not 6.3.7

LiteSpeed Web Server 6.3.7 build 8 (released 3 November 2026) and 6.4.0 RC2 build 6 (same day) both list one security line: Address a critical LSQUIC vulnerability. LiteSpeed Web ADC 3.3.4 (4 November 2026) uses the same wording for lsquic. The public changelog does not assign a CVE, a CVSS, a CWE, or an exploit status. CISA KEV catalog 2026.11.06 (1,769 entries) has no matching LiteSpeed/LSQUIC row for this issue.[1][2][3]

If lshttpd -v already prints 6.3.7, you are not done. 6.3.7 has been shipping since 11 September 2026 (build 0). Builds 0-7 of that version string do not contain this line. The floor is the BUILD file.

What it is

LSQUIC is LiteSpeed’s QUIC / HTTP/3 library, compiled into Enterprise LSWS and into Web ADC. The public changelog names the component and the word critical. It does not name a bug class (use-after-free, overflow, logic), a port, or a request shape. We are not filling that in from forum copies of a customer email.[1][2]

This is not:

  • The September lscgid / CageFS tenant-to-root on Enterprise before 6.3.7 (different advisory, different floor: the version, not build 8).[4]
  • CVE-2026-104474 (OpenLiteSpeed lsup.sh unpacks a nobody-writable tarball as root; floor 1.9.3).[5]
  • CVE-2026-111497 (Brotli). LSWS 6.3.7 build 5 / build 7 already moved Brotli to v1.2.1. Build 8 is a different line.[1]
  • Public GitHub litespeedtech/lsquic v4.11.1 (27 October 2026, “Fix ACK-range merging”). That tag does not claim this critical. Do not git pull LSQUIC from GitHub and call the box patched.[6]

How serious is it?

LiteSpeed’s own changelog word is critical. That is vendor severity, not an NVD vector. There is no CVE ID on the pages we pulled, so there is no NVD Primary / CISA ADP score to cite. It is not on KEV. We have no vendor statement on this page that it is exploited in the wild.[1][2][3]

HTTP/3 is a network listener. If QUIC is on, the library is on the internet path. The changelog still does not say “unauthenticated RCE.” Do not upgrade a host-blog CVSS into a CNA score.

Who is affected

In scope from the public changelogs we fetched:

Product Floor we will treat as patched Source
LiteSpeed Web Server Enterprise 6.3.x 6.3.7 build 8 (3 Nov 2026) LSWS changelog[1]
LiteSpeed Web Server Enterprise 6.4 RC 6.4.0 RC2 build 6 (3 Nov 2026) LSWS changelog[1]
LiteSpeed Web ADC 3.3.4 (4 Nov 2026) ADC changelog[2]

Treat every 6.3.7 build ≤ 7 and every 6.4.0 RC2 build ≤ 5 as not this patch. The changelog does not publish a last-affected version below 6.3.7; if you are still on 6.3.6 or older, you already had other security floors - still move to 6.3.7 build 8, not “any 6.3.7.”

OpenLiteSpeed: the public 1.9.4 notes (26 October 2026) list webadmin default-off, admin_php for PHP2Shell, and Brotli 1.2.1. They do not contain the “critical LSQUIC” sentence. We will not copy reseller pages that name OLS 1.9.4 as this floor. Check OLS again after LiteSpeed publishes, or ask LiteSpeed. 1.9.4 is still the current 1.9.x tag we fetched; it is not proven as this fix by that page.[7]

Not in scope unless you have a separate advisory: WordPress LSCache, the cPanel LiteSpeed plugin KEV IDs (CVE-2026-54420, CVE-2026-48172 - those are 2026-06 / 2026-05 KEV plugin rows, not this LSQUIC line).[3]

What to do now

  1. Read VERSION and BUILD. 6.3.7 without build 8 is the trap. Vendor changelog shows cat lsws/BUILD. Updates doc also mentions /usr/local/lsws/autoupdate/build. Read both if they disagree.[1][8]
/usr/local/lsws/bin/lshttpd -v
cat /usr/local/lsws/VERSION
cat /usr/local/lsws/BUILD
cat /usr/local/lsws/autoupdate/build

Want: version 6.3.7 and BUILD 8 (or higher), or 6.4.0 RC2 with BUILD 6+. ADC: version 3.3.4 or later on the 3.3 train - do not wait for a 3.4.1 string; the public ADC log we pulled tops the security line at 3.3.4.[2]

  1. Force the edge build of 6.3.7. Vendor’s own changelog header is this command.[1][8]
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
cat /usr/local/lsws/BUILD
/usr/local/lsws/bin/lshttpd -v

On cPanel you can also update from the LiteSpeed WHM plugin; still confirm BUILD, not the plugin “6.3.7” label.

  1. Put Stable-tier follow back if you use cron lsup.sh. -f -v removes /usr/local/lsws/autoupdate/follow_stable. Until you touch it again, a parameter-less cron lsup.sh does nothing. That is documented, not a guess.[8]
touch /usr/local/lsws/autoupdate/follow_stable

  1. ADC nodes separately. If Web ADC terminates QUIC in front of origin LSWS, origin build 8 does not patch the edge. Confirm 3.3.4 on the ADC box.[2]

  2. No workaround on the changelog. We are not publishing a “disable HTTP/3” recipe as a vendor fix. If you cannot update today, that is an operational call, not a documented mitigation for this ID-less row. Patch is the action LiteSpeed printed.

  3. After BUILD is 8: confirm the process actually restarted (lswsctrl status / a new pid), and that /usr/local/lsws/logs/error.log is not looping on a failed binary. Then move to the next box. Clusters are per-node.

Versions with no floor

EOL 5.x / abandoned 6.2 trains are not going to grow a build 8. Move the server onto 6.3.7 build 8 (or current 6.4 RC build 6 if you already chose RC). Staying on 6.3.7 build 2 because you patched lscgid in September is not this patch.

OpenLiteSpeed: no LSQUIC-critical floor on the 1.9.x log we fetched. Do not invent one.

Compromise signs

None of these prove this LSQUIC bug. The changelog gives no IoC.

  • BUILD still ≤ 7 on 6.3.7 while UDP/443 is open to the world.
  • lshttpd crash loops or HTTP/3 sessions dying right after 3 Nov, without a matching BUILD 8. Crashes have many causes; do not treat a coredump as confirmation.
  • Unexpected lshttpd binaries versus the package you just installed.

Absence of a log line proves nothing. There is no CVE-specific signature to grep.

FAQ

Is there a CVE? Not on the LSWS or ADC changelog we pulled, and not as a GitHub lsquic security release through v4.11.1. If LiteSpeed publishes an ID later, map it to build 8 / ADC 3.3.4, not to “any 6.3.7.”[1][2][6]

Is it on CISA KEV? No. Catalog 2026.11.06, 1,769 entries. Newest add we saw is CVE-2026-19868 (SonicWall SonicOS SSLVPN, 6 Nov) - unrelated. Older LiteSpeed plugin KEV rows are not this bug.[3]

Does lsup.sh without -f get build 8? Maybe, eventually, if you are on Stable tier and LiteSpeed promotes that build. The vendor page for this drop is the force command. New builds of the same version also do not get the same notifications as a new version number. That is why BUILD is the check.[1][8]

Did build 8 restore alt-php? Yes, as a tuning line: alt-php44 and alt-php51 handlers come back (removed in build 7). That is CloudLinux handler plumbing, not the security fix. Do not skip build 8 because you “don’t run those PHP versions.”[1]

Is this PHP2Shell / WordPress 7.1.4 / CVE-2026-105476? No. Different floors, different updaters (ea-php / wp core / upcp). This one is lsup.sh + BUILD.

Honesty

  • We did not reverse LSQUIC, capture a QUIC packet, or produce a PoC.
  • “Critical” is the changelog adjective. No CVSS from NVD/CISA on this row because no CVE is listed there.
  • Host/reseller write-ups that quote 9.2, unauthenticated RCE, or a 16 November public-diff date are not the vendor changelog. We did not receive LiteSpeed’s customer mail. We are not repeating those numbers as ours.
  • OpenLiteSpeed 1.9.4 is not claimed as this patch from the OLS 1.9.x log.
  • ADC floor is 3.3.4 on docs.litespeedtech.com, not 3.4.1.
  • Public lsquic GitHub through v4.11.1 (27 Oct) does not document this critical.
  • KEV count 1,769 / catalog 2026.11.06 from the JSON we saved this morning.

Sources

  1. LiteSpeed Web Server changelog - 6.3.7 Build 8 and 6.4.0 RC2 Build 6, both 3 Nov 2026, “[Security] Address a critical LSQUIC vulnerability”; header commands cat lsws/BUILD and lsup.sh -f -v 6.3.7; Last-Modified: Fri, 06 Nov 2026 12:46:57 GMT on the HTML we fetched
  2. LiteSpeed Web ADC changelog - Version 3.3.4, 4 Nov 2026, “[Security] Address a critical lsquic vulnerability”
  3. CISA KEV JSON - catalogVersion 2026.11.06, count 1769; no LSQUIC/LSWS row for this issue; plugin KEV CVE-2026-54420 / CVE-2026-48172 are older
  4. ServerGurus: LiteSpeed Enterprise 6.3.7 CageFS - September lscgid/CageFS floor, different bug
  5. CVE-2026-104474 - OpenLiteSpeed lsup.sh LPE, floor 1.9.3
  6. litespeedtech/lsquic releases - latest tag we pulled v4.11.1 (2026-10-27T10:38:28Z)
  7. OpenLiteSpeed 1.9.x release log - V1.9.4 dated 2026-10-26, no “critical LSQUIC” line
  8. Updates with lsup - -f / -v / -b, follow_stable marker behaviour

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales