Facebook Proxygen vulnerabilities
16 published CVEs name Facebook Proxygen among the affected products.
- 16Published CVEs12 of them scored
- 9Last 12 monthspublished in the last year
- 3Critical7 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-121737
When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based HTTP session could…
Facebook · proxygen
Not scored - CVE-2026-119237
In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was…
Facebook · proxygen
Not scored - CVE-2026-119235
proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A…
Facebook · proxygen
Not scored - CVE-2026-119233
proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame,…
Facebook · proxygen
Not scored - CVE-2026-91096
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00)…
Facebook · proxygen
High7.5 - CVE-2026-91095
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could…
Facebook · proxygen
Medium5.3 - CVE-2026-84895
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base…
Facebook · proxygen
High7.3 - CVE-2026-44909
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2…
Facebook · proxygen
High7.5 - CVE-2025-55181
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing…
Facebook · proxygen
Medium5.3 - CVE-2021-24029
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC…
Facebook · mvfst
High7.5