CVE-2026-93903
Description
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
Is your site exposed to CVE-2026-93903?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-93903? +
How do I check if I'm vulnerable to CVE-2026-93903? +
Related Vulnerabilities
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the …
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second …
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware …
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret …
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time …
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load …