CVE-2026-119237 · Runtime
NO FIX YET · SEE WHAT TO DO
Proxygen's HTTP/3 session keeps reading a stream whose headers are blocked on QPACK dynamic table entries, so unread data bypasses the ingress buffer limit and is re-scanned on every read. A remote, unauthenticated peer can send a stalled HEADERS block followed by a continuous data stream, causing memory growth and quadratic CPU use that leads to denial of service.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running proxygen's HTTP/3 server or session code on a public endpoint are exposed, because the flaw is triggered by a remote peer sending a crafted HEADERS block. The sources say QPACK blocked streams are enabled by default, so default configurations are in scope. Deployments that do not run proxygen's HTTP/3 session can skip it.
Not affected if no-http3, non-proxygen-stack
Who cares http3, proxygen, quic, self-hosted
v2026.11.09.00.v2026.11.09.00 or later.In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit, returned flow-control credit to the peer, and was re-scanned in full on every read. With QPACK blocked streams enabled (the default), a remote, unauthenticated HTTP/3 peer could send a HEADERS block that references a dynamic table insert it never sends, followed by a continuous stream of data, causing memory growth until the request timed out and CPU usage that grows quadratically, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.