PatchTheCVEproxygen vulnerabilities and fixes
Recent CVEs affecting proxygen, with upgrade or downgrade steps. 11 tracked.
proxygen has 11 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 11. Most recent: 2025-12-02. Highest priority: CVE-2019-11921 (score 60/100).
- CVE-2025-55181 MEDIUM 5.3 UPGRADE Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro
- CVE-2021-24029 HIGH 7.5 UPGRADE UPGRADE A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which c
- CVE-2020-1897 CRITICAL 9.8 UPGRADE A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious cl
- CVE-2019-11940 CRITICAL 9.8 UPGRADE In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize
- CVE-2019-11921 CRITICAL 9.8 UPGRADE An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to
- CVE-2018-6347 HIGH 7.5 UPGRADE An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack
- CVE-2018-6346 HIGH 7.5 UPGRADE A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically
- CVE-2018-6343 HIGH 7.5 UPGRADE Proxygen fails to validate that a secondary auth manager is set before dereferencing it
- CVE-2015-7265 HIGH 7.5 UPGRADE Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to con
- CVE-2015-7264 CRITICAL 9.8 UPGRADE The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows h
- CVE-2015-7263 HIGH 7.5 UPGRADE The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks a
FAQ
How do I fix proxygen vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is proxygen being exploited right now?
None of the tracked proxygen CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which proxygen CVE should I patch first?
CVE-2019-11921 currently ranks highest (60/100): An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to.