---
cve: "CVE-2025-54939"
severity: "MEDIUM"
cvss: 5.3
epss: "0.8%"
vendor: "litespeedtech"
kev: false
exploited: false
published: "2025-08-01 06:15:28"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T12:21:56+02:00"
---

# CVE-2025-54939

> 5.3 MEDIUM · 🧪 PoC

## Beschreibung

LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Keine | good |
| A Verfügbarkeit | Gering | warn |

## Patch verfügbar (OSV)

- 1a1f503fee8bf4d6b14967bc3874c558e22c5435 (Commit)
- 4cd9252e77fb4a36b572e2167a84067d603d3b23 (Commit)

## Referenzen

- <https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3>
- <https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23>
- <https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation/>
- <https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-54939) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_