Proxygen
Monthly
Use-after-free in Meta's Proxygen HTTP library (v2024.10.28.00 through v2026.09.28.00) lets remote, unauthenticated attackers provoke the invocation of a freed read callback during WebTransport session teardown, because WebTransportImpl::terminateSessionStreams (named WebTransportImpl::destroy in releases before v2025.08.18.00) destroys streams without first unregistering their read callbacks. Only deployments that actually enable WebTransport over HTTP/3 are exposed, and the independent assessment rates this AV:N/AC:H/PR:N/UI:N with high availability impact and low confidentiality impact, since the attacker must open WebTransport streams and drive the session into the specific stream-close/teardown ordering. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.14%, 3rd percentile), so the practical risk is concentrated in services that both use Proxygen and enable WebTransport.
Use-after-free in Meta's proxygen C++ networking library (versions v2026.04.06.00 up to but not including v2026.09.28.00) lets unauthenticated remote clients trigger memory corruption during the teardown of a QUIC WebTransport session, reachable through QuicWtSession::closeSession on deployments that actually serve WebTransport. Per the vector (PR:N) no credentials are needed, but the independent assessment rates the attack complexity as high because exploitation depends on winning the destruction/reference-release sequencing inside the session-close path; practical impact is most likely a denial-of-service crash of the affected service, with partial confidentiality, integrity, and availability effects possible. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is correspondingly low at 0.14% (3rd percentile), with CISA SSVC recording Exploitation: none and Technical Impact: partial.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Memory-safety defect in Meta's Proxygen C++ HTTP library lets the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream callbacks return stream handles that the stream handler had already freed, after which HQSession installs those stale handles as transport read callbacks and can read through freed memory. Only servers built on affected releases (v2024.10.28.00 up to but not including v2026.09.28.00) that actually enable and terminate WebTransport over HTTP/3 are exposed; remote, unauthenticated peers able to drive that stream-setup path can trigger the fault, but the assessed impact is availability only (CVSS 5.3, A:L, no C/I loss) and reliable triggering depends on winning the free-then-reuse timing window. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is very low at roughly 0.14% (3rd percentile).
CVE-2025-55181 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence.05.18.00. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Use-after-free in Meta's Proxygen HTTP library (v2024.10.28.00 through v2026.09.28.00) lets remote, unauthenticated attackers provoke the invocation of a freed read callback during WebTransport session teardown, because WebTransportImpl::terminateSessionStreams (named WebTransportImpl::destroy in releases before v2025.08.18.00) destroys streams without first unregistering their read callbacks. Only deployments that actually enable WebTransport over HTTP/3 are exposed, and the independent assessment rates this AV:N/AC:H/PR:N/UI:N with high availability impact and low confidentiality impact, since the attacker must open WebTransport streams and drive the session into the specific stream-close/teardown ordering. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.14%, 3rd percentile), so the practical risk is concentrated in services that both use Proxygen and enable WebTransport.
Use-after-free in Meta's proxygen C++ networking library (versions v2026.04.06.00 up to but not including v2026.09.28.00) lets unauthenticated remote clients trigger memory corruption during the teardown of a QUIC WebTransport session, reachable through QuicWtSession::closeSession on deployments that actually serve WebTransport. Per the vector (PR:N) no credentials are needed, but the independent assessment rates the attack complexity as high because exploitation depends on winning the destruction/reference-release sequencing inside the session-close path; practical impact is most likely a denial-of-service crash of the affected service, with partial confidentiality, integrity, and availability effects possible. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is correspondingly low at 0.14% (3rd percentile), with CISA SSVC recording Exploitation: none and Technical Impact: partial.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Memory-safety defect in Meta's Proxygen C++ HTTP library lets the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream callbacks return stream handles that the stream handler had already freed, after which HQSession installs those stale handles as transport read callbacks and can read through freed memory. Only servers built on affected releases (v2024.10.28.00 up to but not including v2026.09.28.00) that actually enable and terminate WebTransport over HTTP/3 are exposed; remote, unauthenticated peers able to drive that stream-setup path can trigger the fault, but the assessed impact is availability only (CVSS 5.3, A:L, no C/I loss) and reliable triggering depends on winning the free-then-reuse timing window. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is very low at roughly 0.14% (3rd percentile).
CVE-2025-55181 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence.05.18.00. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.