Denial of Service Vulnerability in mvfst QUIC Server by Meta
CVE-2026-119236

Currently unrated

Key Information:

Vendor

Facebook

Status
Mvfst
Vendor
CVE Published:
11 November 2026

What is CVE-2026-119236?

The mvfst QUIC server experiences a vulnerability where it improperly retains CRYPTO frame data from handshakes that have progressed beyond an initial encryption level. This flaw allows a remote, unauthenticated client to manipulate the handshake process by withholding acknowledgment of the HANDSHAKE_DONE frame, continually sending Handshake-level CRYPTO data. As a result, the server may face unbounded memory growth, which could eventually lead to denial of service conditions.

Affected Version(s)

mvfst v0.0.0.0

References

https://www.facebook.com/security/advisories/cve-2026-119236
x_refsource_CONFIRM
https://github.com/meta/mvfst/commit/7e5cff58e8cbed877931...
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.