EUVD-2026-88544
GHSA-c3mh-7h6x-xh3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOpen HTTP/3 WebTransport stream to server
-
DeliveryManipulate stream handler to free handle
-
ExploitHQSession installs freed handle as read callback
-
ExecutionTrigger read on dangling pointer
-
ImpactUse-after-free crashes service (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to use Proxygen's WebTransport-over-HTTP/3 stream APIs - specifically the HTTPTransaction::onWebTransportUniStream / onWebTransportBidiStream code paths with HQSession installing transport read callbacks. Servers built on Proxygen that do not enable or use WebTransport are not exposed. Affected releases are v2024.10.28.00 up to (not including) v2026.09.28.00. While the CVSS vector is remote and unauthenticated (AV:N/PR:N/UI:N), the realistic impact is limited to crashing the affected process (A:L, no confidentiality or integrity loss), and reliable exploitation depends on winning the free-then-reuse timing window inherent to the use-after-free. |
| Impact | This is a genuine memory-safety defect but a low real-world priority. All signals align on the low end: EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit was identified. The vendor CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is driven entirely by an availability-only impact - Meta scored confidentiality and integrity at None, meaning the practical outcome of this use-after-free is a crash/denial-of-service of the affected process rather than data theft or code execution. Although CWE-416 use-after-free CAN sometimes be leveraged for RCE, the vendor (who reported and rated it) constrained impact to A:L, and there is no evidence of a weaponized info-leak or control-flow-hijack primitive. One important caveat: the CVSS vector is network/unauthenticated (AV:N/PR:N), but exploitation is gated on the application actually using Proxygen's WebTransport-over-HTTP/3 stream APIs - a non-universal deployment condition not reflected in the base vector. A second, explicit discrepancy: the provided fix commit (479eb55) diff only shows changes to HTTPBinaryCodec.cpp (binary-HTTP header parsing), which does NOT correspond to the WebTransport/HQSession use-after-free described - the shown hunks do not contain the actual UAF fix, so the commit either bundles multiple unrelated fixes or the supplied diff is mismatched; verify the fix scope against the vendor advisory. |
| Exploit ScenarioDerived | A remote client establishes an HTTP/3 connection to a Proxygen-based server that has WebTransport enabled, then opens a unidirectional or bidirectional WebTransport stream and manipulates its lifecycle so the stream handler frees the handle while HQSession still installs it as a transport read callback. Subsequent I/O on that dangling handle dereferences freed memory, most realistically crashing the server process (denial of service). No public exploit code has been identified, and the CVSS availability-only impact suggests reliable escalation beyond a crash is not demonstrated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Memory-safety defect in Meta's Proxygen C++ HTTP library lets the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream callbacks return stream handles that the stream handler had already freed, after which HQSession installs those stale handles as transport read callbacks and can read through freed memory. Only servers built on affected releases (v2024.10.28.00 up to but not including v2026.09.28.00) that actually enable and terminate WebTransport over HTTP/3 are exposed; remote, unauthenticated peers able to drive that stream-setup path can trigger the fault, but the assessed impact is availability only (CVSS 5.3, A:L, no C/I loss) and reliable triggering depends on winning the free-then-reuse timing window. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is very low at roughly 0.14% (3rd percentile).
RemediationAI
Vendor-released patch: upgrade Proxygen to v2026.09.28.00 or later, which is the first release outside the affected range; the upstream change is commit 479eb5574195764e80e6cedebef669f6baa85083 and the vendor advisory is at https://www.facebook.com/security/advisories/cve-2026-91095 (EUVD-2026-88544, NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-91095). Where an immediate library upgrade is not possible, the most effective compensating control is to disable WebTransport-over-HTTP/3 on the Proxygen-based server and stop registering the onWebTransportUniStream/onWebTransportBidiStream handlers so HQSession never installs a WebTransport stream handle as a read callback - the trade-off is loss of WebTransport functionality for clients, which must fall back to HTTP/2 or WebSocket-style streaming. Blocking or rate-limiting HTTP/3 WebTransport session establishment at the edge reduces exposure but does not eliminate the bug if WebTransport is still enabled internally, and it adds latency/management overhead. Because the defect is memory corruption adjacent to a codec parsing path, also run the service under a memory-safety-hardened allocator or sanitizer-enabled build during rollout to catch residual dangling-handle dereferences, and monitor for crash loops tied to WebTransport sessions as an indicator of attempted triggering; note that EPSS is low (~0.14%) and no public exploit code or active exploitation has been identified, so remediation can follow normal patch cycles rather than emergency change control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Proxygen is Meta's open-source C++ HTTP stack (CPE cpe:2.3:a:facebook:proxygen) that implements HTTP/1.1, HTTP/2 and HTTP/3, and is the transport layer for services such as load balancers and edge servers. The flaw is a classic CWE-416 use-after-free in the WebTransport-over-HTTP/3 integration: the HTTPTransaction callbacks onWebTransportUniStream and onWebTransportBidiStream are supposed to hand a valid stream handle back to the session, but under the affected releases they could return a handle the stream handler had already destroyed; HQSession then cached that dangling pointer as a transport read callback, producing a later dereference of freed memory when inbound data arrives. The dangling reference and the subsequent use are separated in time, which is why exploit reliability is timing dependent. The repository reference points to upstream commit 479eb5574195764e80e6cedebef669f6baa85083, whose diff reworks HTTPBinaryCodec.h/HTTPBinaryCodec.cpp - introducing persistent state for a partially parsed header field name (pendingFieldName_) and bounding header parsing to a declared field-section length, plus related onIngress/onIngressEOF state handling and byte-accounting fixes - reflecting the library's broader effort to make codec parsing state handling safe across fragmented input.
Know when Proxygen gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote, unauthenticated reachability over HTTP/3 WebTransport with no user interaction; use-after-free yields a process crash only, so C:N/I:N/A:L, matching the vendor.
Primary rating from Vendor (Meta).
CVSS VectorVendor: Meta
Lifecycle Timeline
2DescriptionCVE.org
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking a
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invok
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijac
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass
Use-after-free in Meta's Proxygen HTTP library (v2024.10.28.00 through v2026.09.28.00) lets remote, unauthenticated atta
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a cr
An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. Rated hig
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. Rated high severity (CVSS 7.5),
Exploit-DB