PR
Product
proxygen
On CISA KEVExploited in the wild
11
CVEs
1
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 3High 6Medium 2Low 0
Watch
Add proxygen to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: before 2023.10.16.00 |
| CVE-2026-91096 | 7.5 | Sep 28 | In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister… Affected: v2024.10.28.00 before v2026.09.28.00 |
| CVE-2026-44909 | 7.5 | Jul 23 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer Affected: v2017.01.16.00 before v2026.07.20.00 |
| CVE-2021-24029 | 7.5 | Mar 15 | A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion Affected: before 2021.03.15.00 |
| CVE-2018-6343 | 7.5 | Dec 31 | Proxygen fails to validate that a secondary auth manager is set before dereferencing it Affected: 2018.10.29.00 before 2018.11.19.00 |
| CVE-2026-84895 | 7.3 | Sep 28 | In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method Affected: v2026.04.06.00 before v2026.09.28.00 |
Showing 6