Unbounded Memory Growth in Proxygen via Infinite Loop on Large HTTP Body
CVE-2025-55181 Published on December 2, 2025
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
Weakness Type
Excessive Iteration
The software performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the software or its host system; it depends on the amount of resources consumed per iteration.
Products Associated with CVE-2025-55181
Want to know whenever a new CVE is published for Facebook Proxygen? stack.watch will email you.
Affected Versions
Facebook proxygen:- Version v2025.08.25.00, <= v2025.12.01.00 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.