Unbounded Memory Growth Vulnerability in Proxygen by Facebook

CVE-2025-55181

What is CVE-2025-55181?

An issue exists in Proxygen, where sending an HTTP request or response body larger than 2^31 bytes results in an infinite loop within the proxygen::coro::HTTPQuicCoroSession. This behavior causes the backing event loop to be blocked, leading to unbounded memory growth as data continues to append unconditionally to a std::vector on each loop iteration. Ultimately, this can result in the process exhausting its available memory.

References