PatchTheCVECVE-2019-11921: An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to
CVE-2019-11921 is a critical-severity flaw (CVSS 9.8) affecting proxygen. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.1% (top 19%) |
| CISA exploited list | No |
| Weakness | CWE-787 |
| Published | 2019-07-25 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-11921?
proxygen: upgrade to 2019.07.22.00. Exact commands for each OS are on this page.
Is CVE-2019-11921 being exploited?
CVE-2019-11921 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-11921 affect?
CVE-2019-11921 affects proxygen. Severity is critical (CVSS 9.8). An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of prox
How urgent is CVE-2019-11921?
Priority 60/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-55181 MEDIUM 5.3 UPGRADE Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro
- CVE-2021-24029 HIGH 7.5 UPGRADE UPGRADE A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which c
- CVE-2020-1897 CRITICAL 9.8 UPGRADE A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious cl
- CVE-2019-11940 CRITICAL 9.8 UPGRADE In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize
- CVE-2018-6347 HIGH 7.5 UPGRADE An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack