{"id":"CVE-2026-119237","kind":"vulnerability","aliases":["CVE-2026-119237"],"related":[],"title":"Proxygen HTTP/3: unauthenticated peer can exhaust memory and CPU","description":"In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit, returned flow-control credit to the peer, and was re-scanned in full on every read. With QPACK blocked streams enabled (the default), a remote, unauthenticated HTTP/3 peer could send a HEADERS block that references a dynamic table insert it never sends, followed by a continuous stream of data, causing memory growth until the request timed out and CPU usage that grows quadratically, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00.","summary":"Proxygen's HTTP/3 session keeps reading a stream whose headers are blocked on QPACK dynamic table entries, so unread data bypasses the ingress buffer limit and is re-scanned on every read. A remote, unauthenticated peer can send a stalled HEADERS block followed by a continuous data stream, causing memory growth and quadratic CPU use that leads to denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http3","proxygen","quic","runtime","self-hosted"],"not_affected_if":["no-http3","non-proxygen-stack"],"how_to_check":"- Check the proxygen version in use; affected versions are those prior to `v2026.11.09.00`.\n- Confirm whether HTTP/3 is served by proxygen and whether QPACK blocked streams are enabled (the default, per the sources).","fix":"- proxygen: upgrade to `v2026.11.09.00` or later.","status":"open","published_at":"2026-11-11T17:17:16+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","triaged_at":"2026-11-11T17:29:03+00:00","updated_at":"2026-11-11T17:29:03+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T17:29:03Z","model":"claude-haiku-5-5","output":{"fix":"- proxygen: upgrade to `v2026.11.09.00` or later.","reach":"internet","title":"Proxygen HTTP/3: unauthenticated peer can exhaust memory and CPU","impact":"medium","summary":"Proxygen's HTTP/3 session keeps reading a stream whose headers are blocked on QPACK dynamic table entries, so unread data bypasses the ingress buffer limit and is re-scanned on every read. A remote, unauthenticated peer can send a stalled HEADERS block followed by a continuous data stream, causing memory growth and quadratic CPU use that leads to denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["proxygen","http3","quic","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote peer causes memory growth and CPU exhaustion, denying service.","analyst_note":"","how_to_check":"- Check the proxygen version in use; affected versions are those prior to `v2026.11.09.00`.\n- Confirm whether HTTP/3 is served by proxygen and whether QPACK blocked streams are enabled (the default, per the sources).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-http3","non-proxygen-stack"],"who_is_affected":"Teams running proxygen's HTTP/3 server or session code on a public endpoint are exposed, because the flaw is triggered by a remote peer sending a crafted HEADERS block. The sources say QPACK blocked streams are enabled by default, so default configurations are in scope. Deployments that do not run proxygen's HTTP/3 session can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4714,"output_tokens":621,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119237':12A,15A '-2026':11A,14A 'affect':206C 'block':34B,65B,93C,154C,168C 'buffer':46B,132C 'bypass':43B,127C 'caus':72B,185C 'continu':69B,115C,181C 'control':137C 'could':164C 'cpu':9A,77B,194C 'credit':138C 'cve':10A,13A 'data':42B,70B,126C,184C 'decod':106C 'default':158C 'denial':82B,201C 'dynam':37B,96C,172C 'enabl':156C 'entri':39B,98C 'everi':54B,150C 'exhaust':6A 'flow':136C 'flow-control':135C 'follow':66B,178C 'full':148C 'grow':197C 'growth':74B,187C 'header':32B,64B,92C,105C,167C 'host':22B 'http/3':2A,25B,88C,162C 'http3':16B 'ingress':45B,131C 'insert':174C 'issu':205C 'keep':27B 'lead':80B,199C 'limit':47B,133C 'memori':7A,73B,186C 'never':176C 'paus':111C 'peer':4A,59B,141C,163C 'prior':209C 'proxygen':1A,17B,23B,86C,207C 'qpack':36B,95C,153C 'quadrat':76B,198C 'quic':18B,122C 're':51B,145C 're-scan':50B,144C 'read':28B,55B,117C,151C 'receiv':104C 'refer':170C 'referenc':94C 'remot':57B,160C 'request':190C 'return':134C 'runtim':19B 'scan':52B,146C 'self':21B 'self-host':20B 'send':61B,165C,177C 'servic':84B,203C 'session':26B,89C,114C,129C 'stall':63B 'stream':30B,71B,109C,119C,155C,182C 'tabl':38B,97C,173C 'time':191C 'transport':123C 'unauthent':3A,58B,161C 'unread':41B,125C 'usag':195C 'use':78B 'v2026.11.09.00':211C 'version':208C 'whose':31B 'yet':102C","nicknames":[],"mitigations":[],"who_affected":"Teams running proxygen's HTTP/3 server or session code on a public endpoint are exposed, because the flaw is triggered by a remote peer sending a crafted HEADERS block. The sources say QPACK blocked streams are enabled by default, so default configurations are in scope. Deployments that do not run proxygen's HTTP/3 session can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","http3","proxygen","quic","runtime","selfhosted"],"campaign_type":null,"search_a":"'-119237':12A,15A '-2026':11A,14A 'cpu':9A 'cve':10A,13A 'exhaust':6A 'http/3':2A 'memori':7A 'peer':4A 'proxygen':1A 'unauthent':3A","search_b":"'block':34B,65B 'buffer':46B 'bypass':43B 'caus':72B 'continu':69B 'cpu':77B 'data':42B,70B 'denial':82B 'dynam':37B 'entri':39B 'everi':54B 'follow':66B 'growth':74B 'header':32B,64B 'host':22B 'http/3':25B 'http3':16B 'ingress':45B 'keep':27B 'lead':80B 'limit':47B 'memori':73B 'peer':59B 'proxygen':17B,23B 'qpack':36B 'quadrat':76B 'quic':18B 're':51B 're-scan':50B 'read':28B,55B 'remot':57B 'runtim':19B 'scan':52B 'self':21B 'self-host':20B 'send':61B 'servic':84B 'session':26B 'stall':63B 'stream':30B,71B 'tabl':38B 'unauthent':58B 'unread':41B 'use':78B 'whose':31B","search_c":"'affect':206C 'block':93C,154C,168C 'buffer':132C 'bypass':127C 'caus':185C 'continu':115C,181C 'control':137C 'could':164C 'cpu':194C 'credit':138C 'data':126C,184C 'decod':106C 'default':158C 'denial':201C 'dynam':96C,172C 'enabl':156C 'entri':98C 'everi':150C 'flow':136C 'flow-control':135C 'follow':178C 'full':148C 'grow':197C 'growth':187C 'header':92C,105C,167C 'http/3':88C,162C 'ingress':131C 'insert':174C 'issu':205C 'lead':199C 'limit':133C 'memori':186C 'never':176C 'paus':111C 'peer':141C,163C 'prior':209C 'proxygen':86C,207C 'qpack':95C,153C 'quadrat':198C 'quic':122C 're':145C 're-scan':144C 'read':117C,151C 'receiv':104C 'refer':170C 'referenc':94C 'remot':160C 'request':190C 'return':134C 'scan':146C 'send':165C,177C 'servic':203C 'session':89C,114C,129C 'stream':109C,119C,155C,182C 'tabl':97C,173C 'time':191C 'transport':123C 'unauthent':161C 'unread':125C 'usag':195C 'v2026.11.09.00':211C 'version':208C 'yet':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119237","severity":null,"published_at":"2026-11-11T17:17:16+00:00","modified_at":"2026-11-11T17:17:17+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","fetched_at":"2026-11-11T17:28:21+00:00","note":null}],"documents":[{"id":127297,"url":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}