What is the CVSS score of CVE-2026-44909?

CVE-2026-44909 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Proxygen are affected by CVE-2026-44909?

Meta's Proxygen HTTP library (versions v2017.01.16.00 through v2026.07.20.00) contains a memory-exhaustion vulnerability enabling unauthenticated remote attackers to trigger denial of service.

How to fix or mitigate CVE-2026-44909?

Within 24 hours, identify and inventory all systems running Meta Proxygen HTTP library versions v2017.01.16.00 through v2026.07.20.00; immediately implement network-level rate limiting, strict per-connection HTTP/2 stream limits, and aggressive connection timeouts to constrain attack surface. Within 7 days, deploy automated monitoring for abnormal memory consumption spikes on affected systems, contact Meta support for patching timeline and interim guidance, and establish alerting for potential exploitation attempts. Within 30 days, prepare testing and upgrade plans for when patches become available; if Meta does not commit to a release timeline within your risk tolerance window, evaluate alternative HTTP libraries as a replacement strategy and harden HTTP/2 connection management policies with mandatory slow-client detection and disconnection.

Proxygen CVE-2026-44909

EUVD-2026-48310 HIGH

2026-07-16

GHSA-p9xj-3649-7qp8

Denial Of Service

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP/2 clients trivially abuse flow control (AV:N/AC:L/PR:N/UI:N) causing memory-exhaustion DoS with availability-only impact (A:H; C/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 17:28 vuln.today

Analysis Updated

Jul 23, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 17:22 NVD

7.5 (HIGH)

Analysis Generated

Jul 16, 2026 - 20:23 vuln.today

CVE Published

Jul 16, 2026 - 19:27 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical HTTP/2 DoS via Flow Control Stall in Mozilla - CVE-2026-44909 Jul 16, 2026

AnalysisAI

Memory-exhaustion denial of service in Meta's Proxygen HTTP library (versions v2017.01.16.00 through v2026.07.20.00) allows remote, unauthenticated attackers to force unbounded server-side buffering by abusing HTTP/2 flow control. Because the core HTTP session layer had no generalized slow-consumer detection, a client that advertises SETTINGS_INITIAL_WINDOW_SIZE of 0 or simply withholds WINDOW_UPDATE frames can stall many concurrent streams while fully-generated response bodies pile up in memory. No public exploit identified at time of analysis, but the technique is well-understood and the CVSS 7.5 availability impact is real against default deployments.

Technical ContextAI

Proxygen is Meta's asynchronous C++ HTTP/1.1, HTTP/2 and HTTP/3 (QUIC) library, built on folly, that underpins servers and proxies. The flaw lives in the shared HTTP session layer (HTTPSession/HTTPSessionBase, and the HQ/QUIC equivalents). HTTP/2 (RFC 9113) uses per-stream flow control: a receiver grants send credit via SETTINGS_INITIAL_WINDOW_SIZE and WINDOW_UPDATE frames. When a peer grants zero credit or stops sending WINDOW_UPDATEs, the sender cannot transmit and must hold the produced response body somewhere. Proxygen buffered those complete bodies in memory with no bound and no timer to detect a stream making no forward progress. The root cause is an uncontrolled-resource-consumption / unbounded-allocation class issue (CWE-400 / CWE-770; the input lists CWE as N/A). The fix adds an explicit slow-consumer detector: HTTPSessionBase now tracks bodyBytesWritten_ and a SlowConsumerTimer that arms when pendingWriteSize_ exceeds slowConsumerQueueThreshold_, and drops the connection (dropConnection("slow consumer")) if fewer than slowConsumerMinDequeueBytes_ drain within the configured window.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in Proxygen commit f28742f21f7022c261b7620d4e6b20d82b6cff72 (https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72), which introduces the slow-consumer detector and requires configuring the new thresholds (slowConsumerQueueThreshold_, slowConsumerWindow_, slowConsumerMinDequeueBytes_) so stalled streams are dropped rather than buffered indefinitely; rebuild and redeploy dependent servers against a build that includes it. Because no tagged patched release version is confirmed in the input, verify the fixed tag with Meta before pinning a version, and consult the oss-security post (https://seclists.org/oss-sec/2026/q3/157) and CERT/CC note (https://kb.cert.org/vuls/id/885548). Until patched, apply compensating controls: cap per-connection and per-server pending write/buffer memory so a stalled session is force-closed at a ceiling (trade-off: may terminate legitimately slow mobile clients); limit SETTINGS_MAX_CONCURRENT_STREAMS to shrink the number of simultaneously stallable streams (trade-off: reduces multiplexing throughput for well-behaved clients); enforce a minimum-transmit-progress or idle-write timeout at a fronting proxy/load balancer to reap streams that accept no data; and rate-limit or restrict HTTP/2 access from untrusted networks (trade-off: operational overhead and possible false positives against poor-connectivity users).