Read the docs
TI-2019-08926 Aliases CVE-2019-11921GHSA-87xc-5jfw-gv68

Out-of-bounds write in Meta Proxygen

Priority MEDIUM 46CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.

Why it matters now

EPSS 0.02077 81st percentileScored 2026-11-07
Fix Fixed Proxygen (Facebook): v2019.07.22.00

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaProxygenv2019.07.22.00; before v2019.07.22.00v2019.07.22.00Patch availableCNA
  • Proxygen VendorMeta Affected v2019.07.22.00; before v2019.07.22.00 Fixed in v2019.07.22.00 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*before 2019.07.22.00VulnerableMeta
  • cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:* Versions before 2019.07.22.00 Vulnerable ·Meta

Remediation

  • Fix · CNA Proxygen (Facebook) Fixed in v2019.07.22.00

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11921
  2. 2026-10-03 Alias added: GHSA-87xc-5jfw-gv68

References

Patch 1

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2019-08945 Use after free in Meta Proxygen CVSS 3.1CRITICAL 9.8
  • TI-2020-01824 Use after free in Meta proxygen CVSS 3.1CRITICAL 9.8
  • TI-2018-04667 NULL pointer dereference in Meta Proxygen CVSS 3.1HIGH 7.5
  • TI-2021-06346 Reachable assertion in Meta mvfst CVSS 3.1HIGH 7.5
  • TI-2025-34860 Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences