TI-2019-08945 Aliases CVE-2019-11940 GHSA-qp47-5phq-m7xm

Use after free in Meta Proxygen

MEDIUM 45CWE-416Published 2019-12-04 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.

Why it matters now

EPSS 0.01364 71st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	Proxygen	v2017.04.03.00; v0.29.0 and later	—	No fix listed	CNA

Proxygen VendorMeta Affected v2017.04.03.00; v0.29.0 and later Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:facebook:proxygen::::::::	0.29.0 – 2017.04.03.00	Vulnerable	Meta

cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:* Versions 0.29.0 – 2017.04.03.00 Vulnerable ·Meta

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-11940
2026-10-03 Alias added: GHSA-qp47-5phq-m7xm

References

Patch 1

https://github.com/facebook/proxygen/commit/f43b134cc5c19d8532e7fb670a1c02e85f7a8d4f

Advisory 1

https://www.facebook.com/security/advisories/cve-2019-11940

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2019-08926 Out-of-bounds write in Meta Proxygen CVSS 3.0CRITICAL 9.8
TI-2020-01824 Use after free in Meta proxygen CVSS 3.1CRITICAL 9.8
TI-2018-04667 NULL pointer dereference in Meta Proxygen CVSS 3.1HIGH 7.5
TI-2021-06346 Reachable assertion in Meta mvfst CVSS 3.1HIGH 7.5
TI-2025-34860 Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences