CVE-2026-119235: Security vulnerability
proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and then keep sending data, causing the decoder to buffer it without bound for the lifetime of the connection and exhaust memory, leading to denial of service. The issue occurs regardless of the advertised QPACK dynamic table capacity, including when the dynamic table is disabled. This issue affects proxygen versions prior to v2026.11.09.00.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
proxygento a version that resolves this vulnerability.Fixed in v2026.11.09.00
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using affected proxygen versions prior to v2026.11.09.00 that accept HTTP/3 connections are exposed. The issue is reachable from a remote, unauthenticated HTTP/3 peer.
Does disabling the QPACK dynamic table prevent exploitation?
No. The issue occurs regardless of the advertised QPACK dynamic table capacity, including when the dynamic table is disabled.
What must an attacker do to trigger the denial of service?
An attacker must send an insert instruction on the QPACK encoder stream declaring an arbitrarily large string literal, then continue sending literal data. The decoder buffers the literal before enforcing its size limit, allowing memory exhaustion for the lifetime of the connection.
How can I determine whether an instance is affected?
Check the deployed proxygen version and whether the service accepts HTTP/3 connections. Versions earlier than v2026.11.09.00 are affected.