UpHeron
All vulnerabilities

Servers and applications

CVE-2018-19791

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.

Severity
Medium 6.5
Published
3 Dec 2018
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.5.0
Sources
NVD

Affected software

SoftwareAffected versions
OpenLiteSpeedServers and applications · cpe:a:litespeedtech:openlitespeed
  • Version 1.5.0
  • Version 1.5.0-rc5
  • Version 1.5.0-rc4
  • Version 1.5.0-rc3
All 7 release lines
  • Every version before 1.5.0
  • Version 1.5.0-rc1
  • Version 1.5.0-rc2
  • Version 1.5.0-rc3
  • Version 1.5.0-rc4
  • Version 1.5.0-rc5
  • Version 1.5.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-19791
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-19791