Disabling HTTP/3 as a mitigation for LSQUIC vulnerability

[eurologon]

Hi everyone,
We are running OpenLiteSpeed on CentOS 7 and would like to know how other users are handling the recent LSQUIC security vulnerability.
Since upgrading the OS or OpenLiteSpeed may not be immediately possible, we are considering disabling HTTP/3 (QUIC) as a temporary mitigation.

• Is disabling HTTP/3 sufficient to mitigate this vulnerability?
• What exact command or configuration change should be used on CentOS 7?
• Are there any alternative recommended mitigations?

Any practical experience would be appreciated.
Thank you!

 

[Cold-Egg]

Hi,

Have you tried using the lsup script to upgrade the OpenLiteSpeed binary to the latest version? The latest version should include the patch.

You can find the upgrade instructions here:
https://docs.openlitespeed.org/installation/upgrade/#method-2-lsupsh-script