Medium severity · published Dec 3, 2018
CVE-2018-19791
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the…
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openlitespeed · Litespeedtech
before 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-19791
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-19791
Exploit
https://github.com/litespeedtech/openlitespeed/issues/117
More from Openlitespeed
9.8
CVE-2020-5519
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen
8.8
CVE-2022-0074
Privilege Escalation in OpenLiteSpeed Web Server
8.8
CVE-2022-0073
Authenticated Remote Code Execution in OpenLiteSpeed Web Server
8.8
CVE-2021-26758
Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system
7.5
CVE-2025-54939
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak