CVE-2026-44909

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44909", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "state": "PUBLISHED", "assignerShortName": "Meta", "dateReserved": "2026-05-08T02:33:35.450Z", "datePublished": "2026-07-23T16:27:01.658Z", "dateUpdated": "2026-07-23T19:07:28.874Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "proxygen", "vendor": "Facebook", "versions": [{"lessThan": "v2026.07.20.00", "status": "affected", "version": "v2017.01.16.00", "versionType": "semver"}]}], "dateAssigned": "2026-07-15T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected."}], "problemTypes": [{"descriptions": [{"description": "CWE-770", "lang": "en"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-07-23T16:27:01.658Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T19:07:17.371673Z", "id": "CVE-2026-44909", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T19:07:28.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44909", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T19:07:17.371673Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T19:07:24.780Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Facebook", "product": "proxygen", "versions": [{"status": "affected", "version": "v2017.01.16.00", "lessThan": "v2026.07.20.00", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72", "tags": ["x_refsource_CONFIRM"]}], "dateAssigned": "2026-07-15T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-07-23T16:27:01.658Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44909", "state": "PUBLISHED", "dateUpdated": "2026-07-23T19:07:28.874Z", "dateReserved": "2026-05-08T02:33:35.450Z", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "datePublished": "2026-07-23T16:27:01.658Z", "assignerShortName": "Meta"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "proxygen", "vendor": "Facebook", "versions": [{"lessThan": "v2026.07.20.00", "status": "affected", "version": "v2017.01.16.00", "versionType": "semver"}]}], "source": "cve-assign@fb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected."}, {"lang": "es", "value": "Proxygen carec\u00eda de un mecanismo generalizado de detecci\u00f3n de consumidores lentos en su capa de sesi\u00f3n HTTP central. Un atacante remoto no autenticado podr\u00eda explotar el control de flujo de HTTP/2 al establecer SETTINGS_INITIAL_WINDOW_SIZE en 0 o retener los frames WINDOW_UPDATE, lo que provocar\u00eda que el servidor almacenara en b\u00fafer cuerpos de respuesta completos en memoria indefinidamente para streams estancados. Al abrir muchos streams simult\u00e1neos solicitando recursos grandes mientras se impide que el servidor transmita respuestas, un atacante podr\u00eda inducir un crecimiento ilimitado de la memoria, lo que llevar\u00eda a la degradaci\u00f3n del servicio, el agotamiento de recursos o la denegaci\u00f3n de servicio. Las versiones v2017.01.16.00 hasta la v2026.07.20.00 est\u00e1n afectadas."}], "id": "CVE-2026-44909", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cve-assign@fb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44909", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T19:07:17.371673Z", "version": "2.0.3"}}]}, "published": "2026-07-23T17:16:28.170", "references": [{"source": "cve-assign@fb.com", "url": "https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Deferred"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[v2017.01.16.00,v2026.07.20.00)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "proxygen", "source": "cna", "vendor": "Facebook"}, "product": "proxygen", "vendor": "facebook"}], "created": "2026-07-24T00:00:05.555538+00:00", "title": "HTTP/2 Flow\u2011Control Exploit Causes Unbounded Memory Growth in Proxygen", "updated": "2026-08-02T15:45:03.144189+00:00", "vendors": ["facebook", "facebook$PRODUCT$proxygen"], "weaknesses": ["CWE-399"]}