Denial of Service Vulnerability in Proxygen HTTP/3 Codec by Meta

CVE-2026-119233

What is CVE-2026-119233?

The Proxygen HTTP/3 codec has a vulnerability where it can buffer incomplete non-DATA frames without imposing limits on their length. This flaw allows a remote, unauthenticated HTTP/3 peer to declare excessively large frames that could be delivered at a slow rate. As a result, this can cause unbounded memory growth and significant CPU usage, leading to a denial of service. This issue is pertinent to Proxygen versions prior to v2026.11.09.00, making it crucial for users of affected versions to take immediate action to mitigate potential risks.

References