# CVE-2026-119234: CVE-2026-119234

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC peer could send many small, non-contiguous stream fragments to make an endpoint consume memory far in excess of its advertised receive window and spend increasing CPU time reassembling stream data, leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.0.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Facebook / mvfst: ≥ v0.0.0.0; < v2026.11.09.0 (affected, semver). Source: CNA: Meta

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-770

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.facebook.com/security/advisories/cve-2026-119234 (CNA: Meta; x_refsource_CONFIRM)

- https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44 (CNA: Meta; x_refsource_MISC)

- https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44 (cve-assign@fb.com)

- https://www.facebook.com/security/advisories/cve-2026-119234 (cve-assign@fb.com)

## Provenance

- CNA: Meta: https://www.cve.org/CVERecord?id=CVE-2026-119234; retrieved 2026-11-11; source updated 2026-11-11

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119234; retrieved 2026-11-11; source updated 2026-11-11

Revision: 3f352d0c90256ecdf0752dc3fc1eb4031ca5f46a09bf56d133f5061807d78920

Canonical: https://y2.dev/cve/CVE-2026-119234

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.