Facebook mvfst vulnerabilities
4 published CVEs name Facebook mvfst among the affected products.
- 4Published CVEs2 of them scored
- 2Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-119236
An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because…
Facebook · mvfst
Not scored - CVE-2026-119234
mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC…
Facebook · mvfst
Not scored - CVE-2025-30403
A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to…
Facebook · mvfst
High8.1 - CVE-2021-24029
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC…
Facebook · mvfst
High7.5