CVE-2018-19791

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size…

published December 3, 2018

CVSS
—
EPSS
1%
Percentile
68.9
In the wild
Unconfirmed
What it is

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01239 · 68.9th percentile
Published
2018-12-03T06:00Z
EPSS history
Timeline
  • 03 DEC 06:00Z
    The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size…
    cvelistv5