CVE-2026-91096
UnknownSummary
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.
Risk Assessment
This can lead to a use-after-free condition, potentially causing application crashes or arbitrary code execution by an attacker. It affects services using WebTransport in proxygen.
Recommendation
Update proxygen to version v2026.09.28.00 or later, which contains the fix. If immediate update is not possible, consider disabling WebTransport until the patch is applied.
Other vulnerabilities in proxygen
See all- CVE-2026-91095Unknown
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
- CVE-2026-84895Unknown
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.
- CVE-2026-44909High
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service.
Original NVD description (English source)
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS