Memory Consumption Vulnerability in mvfst by Meta

CVE-2026-119234

What is CVE-2026-119234?

The mvfst library by Meta exhibits a significant memory consumption vulnerability, where it fails to appropriately merge or compact out-of-order STREAM frame data. This allows a remote, unauthenticated QUIC peer to exploit the issue by sending numerous small, non-contiguous stream fragments, leading to excessive memory usage beyond the advertised receive window. The result can be a significant increase in CPU utilization as the system struggles to reassemble fragmented stream data, potentially leading to a denial of service. This vulnerability impacts all mvfst versions prior to v2026.11.09.0, necessitating prompt updates to safeguard against such attacks.

References