proxygen QPACK decoder OOB memory DoS before 2026.11.09.00
CVE-2026-119235 Published on November 11, 2026
proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and then keep sending data, causing the decoder to buffer it without bound for the lifetime of the connection and exhaust memory, leading to denial of service. The issue occurs regardless of the advertised QPACK dynamic table capacity, including when the dynamic table is disabled. This issue affects proxygen versions prior to v2026.11.09.00.
Products Associated with CVE-2026-119235
Want to know whenever a new CVE is published for Facebook Proxygen? stack.watch will email you.
Affected Versions
Facebook proxygen:- Version v0.0.0.0 and below v2026.11.09.00 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.