LiteSpeed 6.3.7 Build 8 — Critical HTTP/3 (LSQUIC) Fix: How to Update

Released 3 November 2026. LiteSpeed Web Server 6.3.7 build 8 fixes a critical vulnerability in LSQUIC, the part of LiteSpeed that handles HTTP/3 (QUIC) connections. HTTP/3 is switched on by default in LiteSpeed Enterprise, so treat every LiteSpeed server as affected until it runs build 8. The update takes a couple of minutes and does not touch your sites' files or databases.

The version number alone does not tell you whether you are safe: 6.3.7 has had several builds, and only build 8 carries this fix.

Am I affected?

Any server running LiteSpeed Web Server Enterprise 6.3.x older than 6.3.7 build 8 is affected, whether it runs cPanel, DirectAdmin, Plesk or no control panel.

Check your version and build as root:

/usr/local/lsws/bin/lshttpd -v
cat /usr/local/lsws/BUILD

You are patched when the version is 6.3.7 and BUILD prints 8 (or higher).

Running the 6.4 release candidate? There the fix is in 6.4.0 RC2 build 6 or later.

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7

This installs the newest build of 6.3.7, which is build 8.

slnLSWS

You can run both steps in one go:

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7 ; slnLSWS

cat /usr/local/lsws/BUILD
/usr/local/lsws/bin/lshttpd -v

BUILD must print 8 and the version must show 6.3.7. Then open a few of your sites to confirm they load normally.

To confirm HTTP/3 is still offered on an HTTPS site, look for the alt-svc header (replace the domain with one of yours):

curl -sI https://yourdomain.com | grep -i alt-svc

Can't update right now? Turn HTTP/3 off for the moment

The flaw sits in the HTTP/3 code. Until you can update, switching HTTP/3 off closes that path, and visitors fall back to HTTP/2 automatically. This is a stopgap only: update as soon as you can.

cPanel (EasyApache 4): add these lines to

/etc/apache2/conf.d/includes/pre_main_global.conf

<IfModule LiteSpeed>
QuicEnable off
</IfModule>

Then rebuild the web server configuration and restart LiteSpeed:

/usr/local/cpanel/scripts/rebuildhttpdconf
/usr/local/lsws/bin/lswsctrl restart

Once you are on build 8, remove those three lines and run the same two commands again to switch HTTP/3 back on.

DirectAdmin, Plesk or no panel: the update in Step 1 is the fix. If you can't run it now, open a ticket and we'll help.

Keep automatic stable updates on (optional)

Forcing a version with -f -v stops a plain lsup.sh run (for example from a cron job) from following LiteSpeed's stable channel. To turn stable-channel updates back on after this update:

touch /usr/local/lsws/autoupdate/follow_stable

What else this update brings

Builds are cumulative, so moving to build 8 also installs every earlier 6.3.7 fix, including:

• September 2026 security fixes. A flaw that could let a website user get around account isolation, including CageFS, and gain root on the server was fixed in the first 6.3.7 builds. If you never moved to 6.3.7, this update closes that too.
• Build 5 (22 October): an updated internal PHP binary for the PHP flaws CVE-2026-109618 and CVE-2026-109619 (your sites' own PHP still needs its own update, see our PHP patch guide), and an updated Brotli library.
• Build 8: brings back the alt-php44 and alt-php51 handlers that build 7 removed, and fixes several ModSecurity edge cases.

LiteSpeed WebAdmin console (port 7080): since build 5 it is switched off by default and must be turned on manually. If it no longer opens after you update, that is expected. Open a ticket if you need it.

Managed-service customers

If your server is under one of our Server Management plans, we apply this update for you. Open a ticket if you'd like confirmation for your server. Not on a plan and would rather we did it? Open a ticket, share access, and we'll update LiteSpeed and verify it for you.