Facebook Proxygen 2024.10.28.00/2026.07.20.00/2026.09.28.00 HTTP/3 Session allocation of resources

Summaryinfo

A vulnerability marked as problematic has been reported in Facebook Proxygen. This impacts an unknown function of the component HTTP/3 Session. Performing a manipulation results in allocation of resources. This vulnerability was named CVE-2026-119237. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Facebook Proxygen. This affects an unknown code of the component HTTP/3 Session. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. This is going to have an impact on availability. The summary by CVE is:

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit, returned flow-control credit to the peer, and was re-scanned in full on every read. With QPACK blocked streams enabled (the default), a remote, unauthenticated HTTP/3 peer could send a HEADERS block that references a dynamic table insert it never sends, followed by a continuous stream of data, causing memory growth until the request timed out and CPU usage that grows quadratically, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00.

The advisory is shared at facebook.com. This vulnerability is uniquely identified as CVE-2026-119237 since 10/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/11/2026). MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 2026.11.09.00 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Social Network Software

Vendor

• Facebook

Name

• Proxygen

Version

• 2024.10.28.00
• 2026.07.20.00
• 2026.09.28.00

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion