OpenLiteSpeed v1.9.0 Now Available

[Lisa Clarke]

Announcing:
OpenLiteSpeed v1.9.0

In this release: Security updates, new WebAdmin UI, bug fixes, and more!

RELEASE LOG:
[Security] Address remote exploit vulnerabilities in HTTP/3 engine.
[Security] Address request smuggling issue for HTTP/2.
[Security] Add `UnsafeAllow3F` rewrite rule flag to address unsafe `%3f` encoded URLs.
[Feature] Add new WebAdmin UI.
[Feature] Add built-in ACME support for auto SSL certificate fetching.
[Feature] Add support for SCGI and uWSGI backends.
[Feature] Drop SPDY protocol support.
[Bug fix] Address various corner cases in AIO, cache module, and Node.js support.

https://openlitespeed.org/release-log/

How to update OpenLiteSpeed: https://openlitespeed.org/kb/how-to-upgrade-openlitespeed/

Cheers!

[Nazmul Hoshen Nazmul Hoshen]

Subject: OpenLiteSpeed dropping POST request bodies (Cloudflare 520 Error) on Webuzo

Message: Hello Support Team,

I am facing a critical issue on multiple servers running Webuzo with OpenLiteSpeed version 1.8.5.

The Issue: Whenever a user submits a POST request with a slightly larger payload (e.g., saving settings in Laravel, payload size around 11KB) while the domain is proxied through Cloudflare (Orange Cloud), the server either:

1. Returns a Cloudflare 520 Error, indicating that OpenLiteSpeed dropped the connection abruptly.
2. Or, OpenLiteSpeed completely drops/strips the Request Body, causing the backend (Laravel) to receive an empty $_POST array, which leads to validation failures or 405 errors.

What we have tested:

• This issue happens with both AJAX requests and standard HTML form submissions.
• We tried turning off Cloudflare Proxy (Grey Cloud). Once we bypass Cloudflare and connect directly to OpenLiteSpeed, the exact same POST request processes perfectly without any errors. This proves the issue is specifically a conflict between Cloudflare and OpenLiteSpeed.
• We suspect it might be related to HTTP/2 chunked transfer encoding bugs in OLS, or some strict internal limit/WAF dropping the payload when it originates from Cloudflare.

Since this is affecting all my sites across multiple Webuzo servers, could you please investigate if there is a known bug in this OLS build (1.8.5) and provide a permanent patch or configuration fix?

Thank you.