CVE-2026-91095 in Proxygen
Summary
by MITRE • 09/29/2026
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Facebook's proxygen library between versions 2024.10.28.00 and 2026.09.28.00 represents a critical class of software defects known as Use-After-Free, which falls under the Common Weakness Enumeration category CWE-416. This specific flaw resides within the HTTPTransaction component's handling of WebTransport streams, specifically affecting the onWebTransportUniStream and onWebTransportBidiStream APIs. These functions are responsible for managing bidirectional and unidirectional stream connections over the QUIC protocol, which is a foundational transport layer technology used by modern high-performance web applications to reduce latency and improve connection multiplexing. The core technical failure occurs when these API methods return stream handles that have already been deallocated or freed by the underlying stream handler logic. This indicates a race condition or improper lifecycle management where the reference counting mechanism fails to account for asynchronous cleanup operations, allowing stale pointers to persist in memory structures that are subsequently accessed.
The operational impact of this vulnerability is severe because it allows an attacker who can trigger these specific code paths through crafted QUIC traffic to induce undefined behavior within the proxygen process. When HQSession receives these invalid stream handles from the HTTPTransaction APIs, it proceeds to install them as transport read callbacks. This action effectively registers a pointer to freed memory for execution or data access during subsequent network I/O operations. If an attacker can control the content of the freed memory region through heap spraying techniques or by manipulating allocation patterns, they may achieve arbitrary code execution with the privileges of the proxygen process. Even without successful exploitation leading to remote code execution, this flaw poses a significant risk to service availability as it frequently results in segmentation faults and application crashes, thereby facilitating Denial-of-Service attacks against services relying on proxygen for HTTP/3 or WebTransport termination.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability maps directly to techniques involving memory corruption exploitation such as T1207 (Rogue Secure Channel Object) if used in conjunction with other vulnerabilities, but more accurately reflects general memory safety violations often exploited via heap-based attacks like Heap Feng Shui. The attack vector typically involves sending malformed or carefully crafted QUIC frames that trigger the creation and immediate destruction of WebTransport streams while simultaneously causing proxygen to retain references to those destroyed objects. This requires network-level access to interact with the vulnerable service, classifying it as a remote exploit requiring authentication only if the target port is exposed without proper access controls. The persistence of these stale handles within HQSession's callback registry creates a persistent window for exploitation until the connection is reset or the session terminates naturally.
Mitigation strategies must prioritize immediate version upgrades to patched releases where this lifecycle management issue has been resolved by ensuring that stream handles are invalidated immediately upon deallocation and that reference counts are strictly maintained across asynchronous boundaries. In environments where upgrading proxygen is not immediately feasible, network-level defenses such as strict rate limiting on QUIC connections can reduce the likelihood of triggering the race condition. Additionally, deploying runtime application self-protection tools or memory safety wrappers like AddressSanitizer in development builds can help detect these violations during testing phases before they reach production. It is also recommended to enforce strict input validation and frame size limits at the network edge to minimize the attack surface available for crafting malicious QUIC streams that exploit this specific handler logic.