CVE-2019-11940: In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize

This month

CRITICAL 9.8REMOTEUPGRADE

CVE-2019-11940 is a critical-severity flaw (CVSS 9.8) affecting proxygen. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.

Why this priority

Critical severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.4% (top 28%)
CISA exploited list	No
Weakness	CWE-416
Published	2019-12-04
Last modified	2026-06-17

Publisher (CNA): Facebook, Inc. · Vendor: facebook

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-12-04 17:16 UTCPublished CVE record published
2026-06-17 02:13 UTCUpdated Record last modified

facebook proxygen UPGRADE

Affected: >= 0.29.0 and <= 2017.04.03.00

Fixed in: newer than 2017.04.03.00

Safe to downgrade to: a release before 0.29.0

1. Check installed version

apt-cache policy proxygen || rpm -q proxygen || proxygen --version

2. UPGRADE to newer than 2017.04.03.00 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade proxygen

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade proxygen

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 0.29.0 (Debian / Ubuntu)

apt-cache madison proxygen sudo apt install proxygen=<VERSION_BEFORE_0.29.0> sudo apt-mark hold proxygen

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list proxygen sudo dnf downgrade proxygen-<VERSION_BEFORE_0.29.0> sudo dnf versionlock add proxygen

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-11940?

proxygen: upgrade to newer than 2017.04.03.00. Exact commands for each OS are on this page.

Is CVE-2019-11940 being exploited?

CVE-2019-11940 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-11940 affect?

CVE-2019-11940 affects proxygen. Severity is critical (CVSS 9.8). In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This i

How urgent is CVE-2019-11940?

Priority 57/100. Critical severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2025-55181 MEDIUM 5.3 UPGRADE Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro
CVE-2021-24029 HIGH 7.5 UPGRADE UPGRADE A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which c
CVE-2020-1897 CRITICAL 9.8 UPGRADE A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious cl
CVE-2019-11921 CRITICAL 9.8 UPGRADE An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to
CVE-2018-6347 HIGH 7.5 UPGRADE An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack

References

← Back to latest CVEs