Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Facebook proxygen v2026.09.28.00 Clear all filters
TI-2026-61880 CVE-2026-91096 · GHSA-8mv4-xrj3-xg7m

Use after free in Meta proxygen

Priority LOW 38

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no l…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00255 Published 2026-09-28 Fixed in v2026.09.28.00 CWE-416
TI-2026-61879 CVE-2026-91095 · GHSA-c3mh-7h6x-xh3f

Use after free in Meta proxygen

Priority LOW 30

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00247 Published 2026-09-28 Fixed in v2026.09.28.00 CWE-416
TI-2026-58357 CVE-2026-84895 · GHSA-ppxw-566f-wjp6

Use after free in Meta proxygen

Priority LOW 37

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00195 Published 2026-09-28 Fixed in v2026.09.28.00 CWE-416