EUVD-2026-88543
GHSA-ppxw-566f-wjp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect over QUIC WebTransport
-
DeliveryEstablish WebTransport session
-
ExploitTrigger session close sequence
-
ExecutionBase handler releases last reference and frees session
-
ImpactPost-free access to member fields (use-after-free)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target proxygen deployment to actually use QUIC WebTransport sessions (the QuicWtSession code path) and to run an affected build between v2026.04.06.00 and v2026.09.28.00; the use-after-free is reached specifically during the session close/teardown path, when the base QuicWtSessionBase::closeSession notifies a session handler that releases the last reference and destroys the session before the derived closeSession finishes accessing its member fields. Limiting factors: servers not exposing WebTransport are not affected, and reliable exploitation beyond a denial-of-service crash depends on winning the destruction/reference-release sequencing, which is non-trivial despite the CVSS AC:L rating. Per the vector (PR:N) the flaw is reachable by unauthenticated remote clients once WebTransport is enabled. |
| Impact | Signals are consistently moderate and mutually reinforcing rather than conflicting. The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) describes a remote, unauthenticated, low-complexity flaw with partial impact across confidentiality, integrity and availability - typical of a use-after-free (CWE-416). However, EPSS is very low at 0.14% (3rd percentile), the CVE is NOT on CISA KEV, and CISA SSVC records Exploitation as 'none' - so this is best treated as 'no public exploit identified at time of analysis.' SSVC does mark Automatable: yes with partial Technical Impact, which modestly raises concern, but EPSS and the absence of KEV/POC indicate this is not currently a widespread or opportunistic exploitation priority. One important caveat: the triggering of a use-after-free during session teardown typically depends on a specific destruction/reference-release sequence, which makes real-world exploitation (beyond a denial-of-service crash) harder than AC:L suggests - I assess the practical complexity as higher than the reported vector. Net: a legitimate memory-safety bug worth patching on a normal cadence, but not an emergency given low EPSS, no KEV, and SSVC exploitation 'none.' Patch availability is CONFIRMED via the upstream GitHub commit and the Facebook security advisory, which is the strongest mitigating factor. |
| Exploit ScenarioDerived | A remote client opens a WebTransport-over-QUIC session against a proxygen-based server and drives the session into a close sequence; QuicWtSession::closeSession notifies the session handler (via the base QuicWtSessionBase::closeSession), the handler releases the last reference and destroys the session, and the outer method then dereferences now-freed member fields. In practice this most reliably yields a crash (denial of service) and potentially limited information disclosure or memory corruption. No public exploit code is identified at time of analysis - only the upstream fix commit is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Use-after-free in Meta's proxygen C++ networking library (versions v2026.04.06.00 up to but not including v2026.09.28.00) lets unauthenticated remote clients trigger memory corruption during the teardown of a QUIC WebTransport session, reachable through QuicWtSession::closeSession on deployments that actually serve WebTransport. Per the vector (PR:N) no credentials are needed, but the independent assessment rates the attack complexity as high because exploitation depends on winning the destruction/reference-release sequencing inside the session-close path; practical impact is most likely a denial-of-service crash of the affected service, with partial confidentiality, integrity, and availability effects possible. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is correspondingly low at 0.14% (3rd percentile), with CISA SSVC recording Exploitation: none and Technical Impact: partial.
RemediationAI
Vendor-released patch: upgrade proxygen to v2026.09.28.00 or later, the first version boundary outside the affected range, and apply the associated upstream fix referenced at https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083 (confirm the commit contents against the advisory at https://www.facebook.com/security/advisories/cve-2026-84895, since the diff surfaced in source evidence touches HTTPBinaryCodec parsing rather than the QuicWtSession close path). If upgrading immediately is not possible, the most targeted compensating control is to disable QUIC WebTransport session support in the proxygen-based service (or stop advertising the extended CONNECT/WebTransport capability), which removes the vulnerable code path entirely - at the cost of losing a legitimate application feature for all users until the patch lands. Because the trigger is a client-initiated session close, rate-limiting or filtering WebTransport traffic does not cleanly prevent the use-after-free and should be treated only as a way to reduce crash-loop impact, not as a fix. Where WebTransport cannot be disabled, restrict network exposure of the affected endpoint to trusted clients and monitor for repeated process crashes in the session-close path as a signal of attempted or accidental triggering; note that no vendor workaround short of upgrading provides a complete guarantee, and the patch should be scheduled as the primary remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in proxygen, Meta's open-source C++ HTTP/1.1, HTTP/2, and HTTP/3 stack built on folly and Fizz, identified by CPE cpe:2.3:a:facebook:proxygen. Specifically, QuicWtSession::closeSession calls the inherited QuicWtSessionBase::closeSession, and the base implementation notifies the session handler as part of teardown; that notification can release the last outstanding reference to the session object, destroying it before the derived closeSession implementation finishes touching its own member fields - a classic lifetime-ordering defect where the base class cannot know that the derived object's destructor-side work is still pending. Because the affected surface is the QUIC/WebTransport (HTTP/3 extended CONNECT) session path, only server or client deployments that enable WebTransport sessions can reach the vulnerable code, and the trigger is a session-close event rather than malformed header parsing. One cross-reference caveat worth noting for verification: the referenced fix commit (479eb5574195764e80e6cedebef669f6baa85083) as surfaced in the source evidence shows changes to HTTPBinaryCodec.cpp/.h covering binary header-section parsing state and pending-field-name handling, which is not obviously the QuicWtSession teardown path described in the advisory; analysts triaging this should confirm the commit-to-CVE mapping against Meta's advisory before treating that diff as the definitive fix for the use-after-free.
Know when Proxygen gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Remote unauthenticated via WebTransport so AV:N/PR:N; AC:H because reaching the post-free access needs a specific teardown/reference-release sequence; impacts partial (C/I/A:L).
Primary rating from Vendor (Meta).
CVSS VectorVendor: Meta
Lifecycle Timeline
3DescriptionCVE.org
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.
Executive ViewAI
Meta's proxygen C++ networking library, used in services that serve QUIC WebTransport sessions, contains a use-after-free vulnerability (CVE-2026-84895) in versions v2026.04.06.00 through v2026.09.27.xx (before v2026.09.28.00) that unauthenticated remote clients can trigger, leading to service crashes and potential partial data compromise. Although no public exploit code or active exploitation has been identified, the absence of a vendor patch forces affected organizations to rely on interim mitigations to protect Internet-facing WebTransport endpoints. Leadership should prioritize identifying and isolating these deployments because a successful attack could disrupt availability and erode customer trust.
Disable WebTransport on affected proxygen deployments if not required; restrict network access to WebTransport endpoints to trusted sources; implement rate limiting and connection throttling; monitor for crashes and abnormal session teardown; apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking a
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invok
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijac
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass
Use-after-free in Meta's Proxygen HTTP library (v2024.10.28.00 through v2026.09.28.00) lets remote, unauthenticated atta
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a cr
An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. Rated hig
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. Rated high severity (CVSS 7.5),
Exploit-DB