CVE-2025-30403

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30403
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30403.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30403
Published
2025-07-11T18:26:51Z
Modified
2026-10-28T10:59:04Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVSS Calculator
Summary
[none]
Details

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.

Database specific 
{
    "cna_assigner":  "facebook",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30403.json"
}
References

Affected packages

Git / github.com/facebook/mvfst

Affected ranges

Type
GIT
Repo
https://github.com/facebook/mvfst
Events
Introduced
04a27a3abe1a3d3007957cefaa33f1a857aa9bbd
Fixed
0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e
Fixed
65b297332191de6e867c4a3139a233fc84c0e7e0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "v2025.03.24.00"
                },
                {
                    "fixed":  "v2025.07.07.00"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "65b297332191de6e867c4a3139a233fc84c0e7e0"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v2025.*
v2025.03.24.00
v2025.03.31.00
v2025.04.07.00
v2025.04.14.00
v2025.04.21.00
v2025.04.28.00
v2025.05.05.00
v2025.05.12.00
v2025.05.19.00
v2025.05.26.00
v2025.06.02.00
v2025.06.09.00
v2025.06.16.00
v2025.06.23.00
v2025.06.30.00

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30403.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "66154746885649362109904122827437880783",
            "length":  2642
        },
        "id":  "CVE-2025-30403-105de900",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/api/QuicTransportBaseLite.cpp",
            "function":  "QuicTransportBaseLite::setTransportSettings"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "287650695290730895663947041437943692527",
            "length":  586
        },
        "id":  "CVE-2025-30403-4157a190",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/client/test/QuicClientTransportLiteTest.cpp",
            "function":  "TEST_F"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "116781476072570602461876207113708255322",
                "27105349069462759149493315450986520237",
                "137536771402702545289774033163851241167",
                "251525687604732085604237495382270894692"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-4f11cec5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/QuicConstants.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "233108783433611068873155223844499901904",
                "216473237400437528216192522175288059007",
                "3147478096539239177101577275015266486",
                "281438216163175558496394532809764692312"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-6ef5ac47",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/api/QuicTransportBaseLite.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "187344482588929990579095793246364203325",
            "length":  577
        },
        "id":  "CVE-2025-30403-91ee7e7d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/QuicConstants.cpp",
            "function":  "filterSupportedVersions"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "323990005885745749291126679678112157738",
                "266829769890763736950382417883164654718",
                "29192514025664769365572854240721927586",
                "182318465581191353929855148086292157266",
                "263546612477312100376619107393480395161"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-989ff145",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/client/test/QuicClientTransportLiteTest.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "232477831293161176066784401015519625870",
                "42378709818803175437181362202123462548",
                "244949138716324703304229447810643802942",
                "37437326570154866425326148781441654795"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-a1534217",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/codec/Types.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "109635496399465194200365249824753989248",
                "268241433506113120131676170924760634205",
                "210433768695664219401397956953288459121",
                "241238244522086551514124920129695241379",
                "94261832321462151248039445531238162804",
                "6513156253446097844455784851518529280",
                "215852990144267569037920970715087428413",
                "296481722082696841595871374931381935909",
                "218001601192870813037414502163739957469",
                "223587628361970460774825732875919793282",
                "4898243644475824479626002985620819604",
                "88171764556776383983025629606954914206"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-b96d41c6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/65b297332191de6e867c4a3139a233fc84c0e7e0",
        "target":  {
            "file":  "quic/server/test/QuicServerTransportTest.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "208723450299243019982314994445398926972",
            "length":  22053
        },
        "id":  "CVE-2025-30403-c273afb7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/65b297332191de6e867c4a3139a233fc84c0e7e0",
        "target":  {
            "file":  "quic/server/QuicServerTransport.cpp",
            "function":  "QuicServerTransport::registerAllTransportKnobParamHandlers"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "96492209806447899905523764011487056445",
                "100121741122958987680831426074754768612",
                "17657221306701325650019868193583681460",
                "228202350172284446699181320771120867600"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-c7092259",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/QuicConstants.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "131352266776178433337981149495555933547",
            "length":  1174
        },
        "id":  "CVE-2025-30403-cab423e0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/65b297332191de6e867c4a3139a233fc84c0e7e0",
        "target":  {
            "file":  "quic/server/test/QuicServerTransportTest.cpp",
            "function":  "TEST_F"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "24261440224663428805631876589838735358",
            "length":  838
        },
        "id":  "CVE-2025-30403-cbcd2f71",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/0ea0f1ceeada14121c3467a54ed57bd2ea4bf64e",
        "target":  {
            "file":  "quic/codec/Types.cpp",
            "function":  "toString"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "112413491556449806323921950655555871787",
                "323003975541744755148479121280525306468",
                "282787821402900262813170755968408752509",
                "93631063314172836112038762810507550986",
                "250827278477683185329084737067662343158"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-d6a6fed0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/65b297332191de6e867c4a3139a233fc84c0e7e0",
        "target":  {
            "file":  "quic/common/BufUtil.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "25318259841628669304498105988064049258",
                "54343792301131539265578558428474522963",
                "135238316927150974846704469556209322648",
                "104483566425259149333323491647665949693",
                "302474871860117260875644444111670109765",
                "88511704264196397464906093098424352689",
                "284566009702899207254084659850051958906",
                "296320280866619474700431786733373419585"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-d8e3ec75",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/65b297332191de6e867c4a3139a233fc84c0e7e0",
        "target":  {
            "file":  "quic/common/test/BufUtilTest.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "62004651989832169906048942366993483805",
                "285551130117691970366812518589171239233",
                "26504857526276584604788099026189146014",
                "53159096773085882321926762415562697007",
                "87683309468235957172019986777384480191"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-30403-e09dc165",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/facebook/mvfst/commit/65b297332191de6e867c4a3139a233fc84c0e7e0",
        "target":  {
            "file":  "quic/server/QuicServerTransport.cpp"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:59:04Z"