Denial of Service Vulnerability in Proxygen by Meta

CVE-2026-119235

What is CVE-2026-119235?

The Proxygen QPACK decoder vulnerability allows a remote, unauthenticated HTTP/3 peer to exploit the encoder-stream instruction, potentially leading to a denial of service. An attacker can craft an insert instruction with an excessively large literal, causing the decoder to buffer data without limit. This can exhaust memory resources throughout the connection, effectively resulting in service unavailability. The vulnerability persists even when the dynamic table capacity is not advertised, or the dynamic table feature is disabled. This issue impacts all versions of Proxygen prior to v2026.11.09.00.

References