CVE-2026-119236

Name of the Vulnerable Software and Affected Versions mvfst versions prior to v2026.11.09.00

Description An mvfst QUIC server retains CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake has already progressed beyond. Since the transport treats this data as delivered, it does not count toward the CRYPTO stream buffer limit. A remote, unauthenticated client can complete a handshake, withhold acknowledgment of the server's HANDSHAKE DONE frame to keep Handshake keys active, and continuously send Handshake-level CRYPTO data at increasing offsets. This process causes unbounded memory growth on the server, resulting in a denial of service.

Recommendations Update to version v2026.11.09.00 or later.