Denial of Service Vulnerability in Proxygen by Facebook

CVE-2026-121737

What is CVE-2026-121737?

A vulnerability exists in Proxygen, a high-performance HTTP framework by Facebook, that can be exploited when a remote, unauthenticated HTTP/1.1 client issues multiple pipelined requests and ceases to read data. This situation can lead to the improper handling of connection streams, resulting in the premature freeing of pipelined streams. If a timeout occurs during this process, it could crash the server, thereby causing a denial of service condition. Additionally, this flaw poses a risk of memory corruption upon subsequent operations. Users are advised to update to Proxygen version v2026.11.09.00 or later to mitigate these issues.

References