5.3
Moyenne
CVE-2026-91095 In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and…
Description
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Proxygen 2024.10 | 2024.10.28.00 → < 2026.09.28.00 | 2026.09.28.00 |
Autres CVE de Proxygen
Les 12 CVE de Proxygen →
CVE-2026-91096
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams…
7.5
Élevée
CVE-2026-84895
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after…
7.3
Élevée
CVE-2026-44909
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer
7.5
Élevée
CVE-2025-55181
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in…
5.3
Moyenne