# CVE-2026-119237: CVE-2026-119237

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit, returned flow-control credit to the peer, and was re-scanned in full on every read. With QPACK blocked streams enabled (the default), a remote, unauthenticated HTTP/3 peer could send a HEADERS block that references a dynamic table insert it never sends, followed by a continuous stream of data, causing memory growth until the request timed out and CPU usage that grows quadratically, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Facebook / proxygen: ≥ v0.0.0.0; < v2026.11.09.00 (affected, semver). Source: CNA: Meta

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-770

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.facebook.com/security/advisories/cve-2026-119237 (CNA: Meta; x_refsource_CONFIRM)

- https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781 (CNA: Meta; x_refsource_MISC)

- https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781 (cve-assign@fb.com)

- https://www.facebook.com/security/advisories/cve-2026-119237 (cve-assign@fb.com)

## Provenance

- CNA: Meta: https://www.cve.org/CVERecord?id=CVE-2026-119237; retrieved 2026-11-11; source updated 2026-11-11

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119237; retrieved 2026-11-11; source updated 2026-11-11

Revision: 56b52a016174ec45fb8205c0c28a64df7bf8fe80f4a4bbc429523f29cbc72ef8

Canonical: https://y2.dev/cve/CVE-2026-119237

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.