Denial of Service Vulnerability in Proxygen's HTTP/3 by Meta

CVE-2026-119237

What is CVE-2026-119237?

In Proxygen's HTTP/3 implementation, a vulnerability exists where HEADERS blocks referencing QPACK dynamic table entries that have not been received can cause significant issues. When a remote, unauthenticated peer sends such HEADERS, it leads to the session continuing to read the stream, bypassing the ingress buffer limit. This can result in unregulated memory growth and increased CPU usage until the request times out, thereby potentially leading to denial of service. This condition is exacerbated when QPACK blocked streams are enabled, making applications susceptible unless upgraded to the versions after v2026.11.09.00.

References