CVE-2026-93903 – LiteSpeed Web Server

This LiteSpeed Web Server update fixes a critical flaw in how the server checks internal redirect URLs. Versions before 6.3.7 build 1 handle redirect URL validation incorrectly in a specific corner case. The weakness comes from improper encoding handling, which lets crafted requests get past the server's redirect checks. CVE-2026-93903 has a CVSS score of 9.4, Critical severity.

LiteSpeed Web Server sits directly in front of public websites and applications, so a flaw in its request handling is directly exposed to attackers. Update to version 6.3.7 build 1 or later on every LiteSpeed host, starting with internet-facing servers.