{"id":"CVE-2026-119236","kind":"vulnerability","aliases":["CVE-2026-119236"],"related":[],"title":"mvfst: QUIC server memory growth lets remote clients cause denial of service","description":"An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could complete a handshake, withhold its acknowledgment of the server's HANDSHAKE_DONE frame so that Handshake keys stay in use, and keep sending Handshake-level CRYPTO data at increasing offsets, causing unbounded memory growth on the server and leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.00.","summary":"An mvfst QUIC server kept CRYPTO frame data sent at handshake levels the TLS handshake had already passed, and did not count it against the buffer limit. A remote, unauthenticated client can keep sending that data to grow server memory without bound, causing denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mvfst","package","quic","self-hosted"],"not_affected_if":["mvfst-not-in-use"],"how_to_check":"- Check the mvfst version in your dependency tree, for example by inspecting the lockfile or build manifest.\n- Confirm whether the QUIC server is reachable from the internet or from untrusted networks.","fix":"- mvfst: upgrade to `v2026.11.09.00` or later","status":"open","published_at":"2026-11-11T17:17:16+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","triaged_at":"2026-11-11T17:29:03+00:00","updated_at":"2026-11-11T17:29:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T17:29:03Z","model":"claude-haiku-5-5","output":{"fix":"- mvfst: upgrade to `v2026.11.09.00` or later","reach":"internet","title":"mvfst: QUIC server memory growth lets remote clients cause denial of service","impact":"medium","summary":"An mvfst QUIC server kept CRYPTO frame data sent at handshake levels the TLS handshake had already passed, and did not count it against the buffer limit. A remote, unauthenticated client can keep sending that data to grow server memory without bound, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["mvfst","quic","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote client exhausts server memory, causing denial of service","analyst_note":"","how_to_check":"- Check the mvfst version in your dependency tree, for example by inspecting the lockfile or build manifest.\n- Confirm whether the QUIC server is reachable from the internet or from untrusted networks.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["mvfst-not-in-use"],"who_is_affected":"Teams that run a QUIC server built on mvfst and accept connections from untrusted clients. The sources do not say which products or default configurations embed mvfst, so teams should check their dependency tree for it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000714,"input_tokens":4680,"output_tokens":492,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119236':15A,18A '-2026':14A,17A 'acknowledg':123C 'affect':164C 'alreadi':41B,92C 'bound':66B 'buffer':50B,111C 'caus':9A,67B,149C 'client':8A,55B,116C 'complet':118C 'could':117C 'count':46B,106C 'crypto':30B,76C,109C,144C 'cve':13A,16A 'data':32B,60B,78C,100C,145C 'deliv':102C 'denial':10A,68B,159C 'done':129C 'encrypt':82C 'frame':31B,77C,130C 'grow':62B 'growth':5A,152C 'handshak':35B,39B,86C,90C,120C,128C,133C,142C 'handshake-level':141C 'host':24B 'increas':147C 'initi':84C 'issu':163C 'keep':57B,139C 'kept':29B 'key':134C 'lead':157C 'let':6A 'level':36B,83C,143C 'limit':51B,112C 'memori':4A,64B,151C 'move':93C 'mvfst':1A,19B,26B,72C,165C 'offset':148C 'packag':20B 'pass':42B 'past':94C 'prior':167C 'quic':2A,21B,27B,73C 'receiv':79C 'remot':7A,53B,114C 'retain':75C 'self':23B 'self-host':22B 'send':58B,140C 'sent':33B 'server':3A,28B,63B,74C,126C,155C 'servic':12A,70B,161C 'stay':135C 'stream':110C 'tls':38B,89C 'transport':97C 'treat':98C 'unauthent':54B,115C 'unbound':150C 'use':137C 'v2026.11.09.00':169C 'version':166C 'withhold':121C 'without':65B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a QUIC server built on mvfst and accept connections from untrusted clients. The sources do not say which products or default configurations embed mvfst, so teams should check their dependency tree for it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","mvfst","package","quic","selfhosted"],"campaign_type":null,"search_a":"'-119236':15A,18A '-2026':14A,17A 'caus':9A 'client':8A 'cve':13A,16A 'denial':10A 'growth':5A 'let':6A 'memori':4A 'mvfst':1A 'quic':2A 'remot':7A 'server':3A 'servic':12A","search_b":"'alreadi':41B 'bound':66B 'buffer':50B 'caus':67B 'client':55B 'count':46B 'crypto':30B 'data':32B,60B 'denial':68B 'frame':31B 'grow':62B 'handshak':35B,39B 'host':24B 'keep':57B 'kept':29B 'level':36B 'limit':51B 'memori':64B 'mvfst':19B,26B 'packag':20B 'pass':42B 'quic':21B,27B 'remot':53B 'self':23B 'self-host':22B 'send':58B 'sent':33B 'server':28B,63B 'servic':70B 'tls':38B 'unauthent':54B 'without':65B","search_c":"'acknowledg':123C 'affect':164C 'alreadi':92C 'buffer':111C 'caus':149C 'client':116C 'complet':118C 'could':117C 'count':106C 'crypto':76C,109C,144C 'data':78C,100C,145C 'deliv':102C 'denial':159C 'done':129C 'encrypt':82C 'frame':77C,130C 'growth':152C 'handshak':86C,90C,120C,128C,133C,142C 'handshake-level':141C 'increas':147C 'initi':84C 'issu':163C 'keep':139C 'key':134C 'lead':157C 'level':83C,143C 'limit':112C 'memori':151C 'move':93C 'mvfst':72C,165C 'offset':148C 'past':94C 'prior':167C 'quic':73C 'receiv':79C 'remot':114C 'retain':75C 'send':140C 'server':74C,126C,155C 'servic':161C 'stay':135C 'stream':110C 'tls':89C 'transport':97C 'treat':98C 'unauthent':115C 'unbound':150C 'use':137C 'v2026.11.09.00':169C 'version':166C 'withhold':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119236","severity":null,"published_at":"2026-11-11T17:17:16+00:00","modified_at":"2026-11-11T17:17:16+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","fetched_at":"2026-11-11T17:28:21+00:00","note":null}],"documents":[{"id":127298,"url":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}