GCVE - cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Facebook (`c319c35a-3469-5baa-b3bd-8582d1206a92`)
Product	Proxygen (`dab6b8c6-d427-5631-ab2c-59b59d4b7db8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/facebook/proxygen`	purl2cpe	2026-06-01 10:11:42.675984
`pkg:rpm/fedora/proxygen`	purl2cpe	2026-06-01 10:11:42.675987
`pkg:sourceforge/proxygen`	purl2cpe	2026-06-01 10:11:42.675990

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-44909`	vulnerable	2026-07-29 00:52:14.915245	Details available HIGH (7.5) Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected. Published: 2026-07-23T16:27:01.658Z Updated: 2026-07-23T19:07:28.874Z Open on db.gcve.eu Reference links https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-55181`	vulnerable	2026-06-08 07:33:14.235038	Details available MEDIUM (5.3) Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory. Published: 2025-12-02T22:13:31.101Z Updated: 2025-12-03T00:33:57.022Z Open on db.gcve.eu Reference links https://www.facebook.com/security/advisories/cve-2025-55181 https://github.com/facebook/proxygen/commit/17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-44487`	vulnerable	2026-06-08 06:12:41.186461	Details available The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Published: 2023-10-10T00:00:00.000Z Updated: 2026-07-14T12:03:17.389Z Open on db.gcve.eu Reference links https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24029`	vulnerable	2026-06-08 05:30:03.508011	Details available A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00. Published: 2021-03-15T21:15:16.000Z Updated: 2024-08-03T19:21:17.115Z Open on db.gcve.eu Reference links https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee2839da6338032030d712b0 https://www.facebook.com/security/advisories/cve-2021-24029	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24029`	not_vulnerable	2026-06-08 05:30:03.507933	Details available A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00. Published: 2021-03-15T21:15:16.000Z Updated: 2024-08-03T19:21:17.115Z Open on db.gcve.eu Reference links https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee2839da6338032030d712b0 https://www.facebook.com/security/advisories/cve-2021-24029	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-1897`	vulnerable	2026-06-08 05:21:03.485237	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-11940`	vulnerable	2026-06-08 05:12:38.325512	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-11921`	vulnerable	2026-06-08 05:12:38.285639	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6347`	vulnerable	2026-06-08 05:11:53.630192	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6346`	vulnerable	2026-06-08 05:11:53.628339	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6343`	vulnerable	2026-06-08 05:11:53.624044	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.