Remote Code Execution Vulnerability in Proxygen by Facebook

CVE-2026-44909

What is CVE-2026-44909?

Proxygen, a high-performance HTTP framework developed by Facebook, is susceptible to a remote code execution vulnerability due to the absence of a slow-consumer detection mechanism within its core HTTP session layer. This deficiency allows unauthenticated remote attackers to exploit flow-control features of HTTP/2 by manipulating the SETTINGS_INITIAL_WINDOW_SIZE to zero or preventing WINDOW_UPDATE frames from being sent. By initiating numerous simultaneous streams that request substantial resources while obstructing the server's response transmissions, an attacker can provoke unbounded memory growth on the server, potentially resulting in significant service degradation, resource depletion, or a complete denial of service. The vulnerability affects Proxygen versions ranging from v2017.01.16.00 to v2026.07.20.00.

References