Facebook Proxygen vulnerabilities

• facebook proxygen In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams ... CVE-2026-91096 7.5 HighSeptember 28, 2026
• facebook proxygen In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction:... CVE-2026-91095 5.3 MediumSeptember 28, 2026
• facebook proxygen In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its... CVE-2026-84895 7.3 HighSeptember 28, 2026
• facebook proxygen Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A... CVE-2026-44909 7.5 HighJuly 23, 2026
• facebook proxygen Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in... CVE-2025-55181 5.3 MediumDecember 2, 2025
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• facebook mvfst, proxygen +1 more A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC... CVE-2021-24029 7.5 HighMarch 15, 2021
• facebook proxygen A use-after-free is possible due to an error in lifetime management in the request adaptor when a... CVE-2020-1897 9.8 CriticalMay 18, 2020
• facebook proxygen In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header... CVE-2019-11940 9.8 CriticalDecember 4, 2019
• facebook proxygen An out of bounds write is possible via a specially crafted packet in certain configurations of... CVE-2019-11921 9.8 CriticalJuly 25, 2019
• facebook proxygen An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of... CVE-2018-6347 7.5 HighDecember 31, 2018
• facebook proxygen A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings ... CVE-2018-6346 7.5 HighDecember 31, 2018
• facebook proxygen Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can... CVE-2018-6343 7.5 HighDecember 31, 2018