Skip to content
Sign in
5.3 Medium

CVE-2026-91095 In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and…

Description

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.

Affected products and versions

Product Affected versions Fixed in
Proxygen 2024.10 2024.10.28.00 → < 2026.09.28.00 2026.09.28.00

Other CVEs of Proxygen

The 12 CVEs of Proxygen →
CVE-2026-91096 In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams… 7.5 High CVE-2026-84895 In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after… 7.3 High CVE-2026-44909 Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer 7.5 High CVE-2025-55181 Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in… 5.3 Medium
Track this CVE