CVE-2026-44909
Deferred Deferred - Pending Action

Memory Exhaustion in Proxygen via HTTP/2 Flow Control

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Facebook, Inc.

Description
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-44909
EUVD
EUVD-2026-48310

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
facebook proxygen From 2017.01.16.00 (inc) to 2026.07.20.00 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Proxygen versions v2017.01.16.00 through v2026.07.20.00 lack a slow-consumer detection mechanism. An attacker can exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames. This causes the server to buffer complete response bodies in memory indefinitely for stalled streams, leading to unbounded memory growth and potential denial of service.

Detection Guidance

Monitor Proxygen server logs for stalled HTTP/2 streams or excessive memory usage. Check for connections with SETTINGS_INITIAL_WINDOW_SIZE set to 0 or missing WINDOW_UPDATE frames. Use network tools like tcpdump or Wireshark to inspect HTTP/2 traffic for flow-control manipulation attempts.

Impact Analysis

This vulnerability can cause service degradation, resource exhaustion, or denial of service. Attackers can open many simultaneous streams requesting large resources while preventing the server from transmitting responses, leading to excessive memory usage and system unavailability.

Compliance Impact

This vulnerability could lead to denial of service or resource exhaustion, potentially disrupting services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade Proxygen to a version beyond v2026.07.20.00. Enable the slow-consumer detector in HTTPSessionBase by setting slow consumer parameters. Configure firewalls or load balancers to limit concurrent connections and request rates from single sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44909. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart