Proxygen (Facebook) - vulnerabilities (CVEs)
12 CVEs, 3 in the last 30 days, 474 known versions, newest CVE from 2026-09-28. Vendor: Facebook.
CVEs of Proxygen
- CVE-2026-91096 - CVSS 7.5 (high), 2026-09-28: In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00)…
- CVE-2026-91095 - CVSS 5.3 (medium), 2026-09-28: In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could…
- CVE-2026-84895 - CVSS 7.3 (high), 2026-09-28: In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base…
- CVE-2026-44909 - CVSS 7.5 (high), 2026-07-23: Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2…
- CVE-2025-55181 - CVSS 5.3 (medium), 2025-12-02: Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing…
- CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
- CVE-2021-24029 - CVSS 7.5 (high), 2021-03-15: A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC…
- CVE-2020-1897 - CVSS 9.8 (critical), 2020-05-18: A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a…
- CVE-2019-11940 - CVSS 9.8 (critical), 2019-12-04: In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a…
- CVE-2019-11921 - CVSS 9.8 (critical), 2019-07-25: An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing…
- CVE-2018-6347 - CVSS 7.5 (high), 2018-12-31: An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00.
- CVE-2018-6346 - CVSS 7.5 (high), 2018-12-31: A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen…
- CVE-2018-6343 - CVSS 7.5 (high), 2018-12-31: Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a…
