CVE-2026-44909

Name of the Vulnerable Software and Affected Versions Proxygen versions v2017.01.16.00 through v2026.07.20.00

Description The core HTTP session layer lacks a generalized slow-consumer detection mechanism. A remote, unauthenticated attacker can exploit HTTP/2 flow-control by setting SETTINGS INITIAL WINDOW SIZE to 0 or withholding WINDOW UPDATE frames. This forces the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening numerous simultaneous streams for large resources and preventing response transmission, an attacker can cause unbounded memory growth, resulting in resource exhaustion, service degradation, or denial of service.

Recommendations Update Proxygen to a version later than v2026.07.20.00.