CVE-2026-44909

{
  "id": "CVE-2026-44909",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-23T17:16:28.170",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected."
    },
    {
      "lang": "es",
      "value": "Proxygen carecía de un mecanismo generalizado de detección de consumidores lentos en su capa de sesión HTTP central. Un atacante remoto no autenticado podría explotar el control de flujo de HTTP/2 al establecer SETTINGS_INITIAL_WINDOW_SIZE en 0 o retener los frames WINDOW_UPDATE, lo que provocaría que el servidor almacenara en búfer cuerpos de respuesta completos en memoria indefinidamente para streams estancados. Al abrir muchos streams simultáneos solicitando recursos grandes mientras se impide que el servidor transmita respuestas, un atacante podría inducir un crecimiento ilimitado de la memoria, lo que llevaría a la degradación del servicio, el agotamiento de recursos o la denegación de servicio. Las versiones v2017.01.16.00 hasta la v2026.07.20.00 están afectadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Facebook",
          "product": "proxygen",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "v2017.01.16.00",
              "lessThan": "v2026.07.20.00",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T19:07:17.371673Z",
          "id": "CVE-2026-44909",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72",
      "source": "[email protected]"
    }
  ]
}