CVE-2026-119234
- Source
- https://cve.org/CVERecord?id=CVE-2026-119234
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119234.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-119234
- Published
- 2026-11-11T17:17:16Z
- Modified
- 2026-11-14T13:28:01Z
- Summary
- [none]
- Details
-
mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC peer could send many small, non-contiguous stream fragments to make an endpoint consume memory far in excess of its advertised receive window and spend increasing CPU time reassembling stream data, leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.0.
- References
Affected packages
Git / github.com/meta/mvfst
Affected ranges
- Type
- GIT
- Repo
- https://github.com/meta/mvfst
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "2026.11.09.0" } ], "source": "DESCRIPTION" }, { "range": [ { "fixed": "7e5cff58e8cbed87793141ceeca0a8a343c67c44" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v2023.*
v2023.07.24.00
v2023.08.07.00
v2023.08.14.00
v2023.08.28.00
v2023.09.04.00
v2023.09.11.00
v2023.09.18.00
v2023.09.25.00
v2023.10.02.00
v2023.10.09.00
v2023.10.16.00
v2023.10.23.00
v2023.10.30.00
v2023.11.06.00
v2023.11.13.00
v2023.11.20.00
v2023.11.27.00
v2023.12.04.00
v2023.12.11.00
v2023.12.18.00
v2023.12.25.00
v2024.*
v2024.01.01.00
v2024.01.08.00
v2024.01.15.00
v2024.01.22.00
v2024.01.29.00
v2024.02.05.00
v2024.02.12.00
v2024.02.19.00
v2024.02.26.00
v2024.03.04.00
v2024.03.11.00
v2024.03.18.00
v2024.03.25.00
v2024.04.01.00
v2024.04.08.00
v2024.04.15.00
v2024.04.22.00
v2024.04.29.00
v2024.05.02.00
v2024.05.06.00
v2024.05.13.00
v2024.05.20.00
v2024.05.27.00
v2024.06.03.00
v2024.06.10.00
v2024.06.17.00
v2024.06.24.00
v2024.07.01.00
v2024.07.08.00
v2024.07.15.00
v2024.07.22.00
v2024.07.29.00
v2024.08.05.00
v2024.08.12.00
v2024.08.19.00
v2024.08.26.00
v2024.09.02.00
v2024.09.09.00
v2024.09.16.00
v2024.09.23.00
v2024.09.30.00
v2024.10.07.00
v2024.10.14.00
v2024.10.21.00
v2024.10.28.00
v2024.11.04.00
v2024.11.11.00
v2024.11.18.00
v2024.11.25.00
v2024.12.02.00
v2024.12.09.00
v2024.12.16.00
v2024.12.23.00
v2024.12.30.00
v2025.*
v2025.01.06.00
v2025.01.13.00
v2025.01.20.00
v2025.01.27.00
v2025.02.03.00
v2025.02.10.00
v2025.02.17.00
v2025.02.24.00
v2025.03.03.00
v2025.03.10.00
v2025.03.17.00
v2025.03.24.00
v2025.03.31.00
v2025.04.07.00
v2025.04.14.00
v2025.04.21.00
v2025.04.28.00
v2025.05.05.00
v2025.05.12.00
v2025.05.19.00
v2025.05.26.00
v2025.06.02.00
v2025.06.09.00
v2025.06.16.00
v2025.06.23.00
v2025.06.30.00
v2025.07.07.00
v2025.07.14.00
v2025.07.21.00
v2025.07.28.00
v2025.08.04.00
v2025.08.11.00
v2025.08.18.00
v2025.08.25.00
v2025.09.01.00
v2025.09.08.00
v2025.09.15.00
v2025.09.22.00
v2025.09.29.00
v2025.10.06.00
v2025.10.13.00
v2025.10.20.00
v2025.10.27.00
v2025.11.03.00
v2025.11.10.00
v2025.11.17.00
v2025.11.24.00
v2025.12.01.00
v2025.12.15.00
v2025.12.22.00
v2025.12.29.00
v2026.*
v2026.01.05.00
v2026.01.12.00
v2026.01.19.00
v2026.01.26.00
v2026.02.02.00
v2026.02.09.00
v2026.02.16.00
v2026.02.23.00
v2026.03.02.00
v2026.03.09.00
v2026.03.16.00
v2026.03.23.00
v2026.03.30.00
v2026.04.06.00
v2026.04.13.00
v2026.04.20.00
v2026.04.27.00
v2026.05.04.00
v2026.05.11.00
v2026.05.18.00
v2026.05.25.00
v2026.06.01.00
v2026.06.08.00
v2026.06.15.00
v2026.06.22.00
v2026.06.29.00
v2026.07.06.00
v2026.07.13.00
v2026.07.20.00
v2026.07.27.00
v2026.08.03.00
v2026.08.10.00
v2026.08.17.00
v2026.08.24.00
v2026.08.31.00
v2026.09.07.00
v2026.09.14.00
v2026.09.21.00
v2026.09.28.00
v2026.10.05.00
v2026.10.12.00
v2026.10.19.00
v2026.10.26.00
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119234.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"76727250114250757125910198345051611799",
"109355734001361688163948626083408924134",
"166228991637490959188414345110282105886",
"202629258858385320321541160966072317320",
"59979440951488266505799065297413318497",
"261340746860166116874154551406233419649",
"266689551779680906228555189978183705231",
"157817276986241489210063066158886299863",
"22142176435242819574679220589463163615",
"313476897367261105278353943429063159883",
"191735217072808576489950461579454240897",
"10294001794970172267228707607301705236",
"84049974536274073260601672085153375590",
"166121122795391765828165251371412126013",
"280019240872068096836478801534800109677",
"144161861878417217222375861537667633891"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-02005fda",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/common/ContiguousCursor.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "52999020636310987241096893444091115988",
"length": 366
},
"id": "CVE-2026-119234-061236ff",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamManager.cpp",
"function": "QuicStreamManager::clearOpenStreams"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "20992700338558858527676888628399953800",
"length": 284
},
"id": "CVE-2026-119234-08c222b2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamFunctions.cpp",
"function": "appendDataToReadBuffer"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "285650976204211221812773472439870328394",
"length": 358
},
"id": "CVE-2026-119234-152be424",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/common/BufUtil.cpp",
"function": "fillIovec"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83326038603688868828785134851563782176",
"256816563015245025029241610270733619027",
"204169165240516646712648290209667644221",
"72443399672281481985108018997771905005",
"261734619491249298942292281576428672451",
"108045249587896933637495020670185407421",
"62063146427456024073321403822500914255",
"334977800159687243962685682804581266123",
"312184611052355197156724847931033604373",
"220034328397778536268834671805219075559",
"242820019319747632467903295573777929021",
"154768790483385124576313241294285556645",
"319223573938573801493019577494715598141",
"335606088737682545383809584729041357246",
"197489828553870088368031822331967247310",
"229826400466925194122000687015750609705",
"276820499424868182312691907720651878684",
"109029592124602955457252458248466881324",
"9425612526940913183007371376667334283",
"148349563911401873262604417856870073509"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-190272ee",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/common/udpsocket/QuicAsyncUDPSocketImpl.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "117160165359804115562710716474173559840",
"length": 1009
},
"id": "CVE-2026-119234-1c55b81f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamFunctions.cpp",
"function": "readDataFromQuicStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"190907153878062741029053406123710616608",
"207391061791620231187364137347435941704",
"81790574777895057719648658577597735506",
"244047087470572626937269635679326740230",
"252187565370676203217543740462309766021",
"251242758619375125364909569230476216594",
"329912927360665792850865535596013345921",
"152231444783283483859139005467633600663",
"134174626914964868702849693668118941764"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-20202284",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/api/QuicTransportBaseLite.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "240688870411873807980269580792624924961",
"length": 906
},
"id": "CVE-2026-119234-213a1378",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamFunctions.cpp",
"function": "consumeDataFromQuicStream"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206326542533718516512250830283197578528",
"length": 3110
},
"id": "CVE-2026-119234-3613241c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamManager.cpp",
"function": "QuicStreamManager::removeClosedStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166043063087339323482509734807307574707",
"100115309024530175783034013667954813142",
"90989211952165404992579450972793447481",
"218842867255346669496485488778586086840",
"40989405804651720223445611528495250403",
"30902321820957996970169773314930176709",
"296206630711684426620988196488029623750",
"5594161084209212503840895928694685134"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-3833e952",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/common/ContiguousCursor.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "165622074001850534568531364138824716426",
"length": 4246
},
"id": "CVE-2026-119234-3d971ea3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/common/udpsocket/QuicAsyncUDPSocketImpl.cpp",
"function": "QuicAsyncUDPSocketImpl::recvmmsgNetworkData"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172933406495097381301247852137125673199",
"93263765849229485197508213512578436609",
"149927866449672659567985471594484780863",
"133073042797734606632430077549061314109",
"260241034750878034170520069554886203882",
"213106691768080592275780234762635104754",
"60508541644474044130995212717045313588",
"3155903335335332888265911714346797397",
"106446475866392097211965087437196876727",
"223117992349712410599942216007731500578",
"190380360411864515659065456790486174290",
"292791029161717257679892251263665519956",
"32551475189669653869641480142437822132",
"190192832189787277142831043660748238343",
"96908095064963469945128250708264369278",
"150773622809018122399486160754840758093",
"192709161131969813590274427915196747335",
"282819735292409566612641150541063999557",
"57931410775902619637601870290419709008",
"248178816924680551759296835103052119443",
"263055047005836967385434963935485127985",
"321134419058086729343000153625571034613",
"53023400051919763417739479692652587663",
"137293556450403648052220896039586194081",
"293443358623596320692910875016162186160",
"21497429062229852429153302348998769166",
"111736786313136755676907272509900369589",
"248901130094671406404260425550621207470",
"85230730578467097194973420895136569996",
"81250033974957209283979388091183616155",
"13114518927545096829485598610372242750",
"273980314797654851681674002268624685590",
"92347618516775411051314007845601584074",
"88052854537792835042396040920569413961",
"133392494280874035650174975792640088125",
"287124101854647475842426880166754905792",
"188518487702007312616162304532289342763",
"307574231139314398467449811702385563927",
"12847159617142049210844493588782174792",
"212099104116782054971581964358336049405",
"336492008065982985048766049386100533582",
"191939685333072302296178688440469548155",
"330417533061679252790992700112595590573",
"57846625080667235870332853022904793647",
"198058179854119663559325954400628419498",
"170514921101908499432838413615217009103",
"192783381306543021856439074550118141480",
"291142965426471439030892442399215440079",
"63798859445393944587981685549415810637",
"84208163321926531212794819658329974235",
"152980541757531767881535066752371958393",
"64845784493513996521362386481615987847",
"189614336477138032509692791966211120413",
"264213045113754134991840534378447346738",
"292692842608788337789821484019061505753",
"97939142382044880073624068379766086489",
"208704428340460855996635160923908380151",
"228469785589860637782223004722487249338",
"41035503051683687272139774093296614297",
"69052668898500961973602709949010635561",
"100918700088306849269870596619736496157",
"27054755676374394069199711239577019332",
"158592780656963327265807833706850681082",
"188048159692944135321155822466383518813",
"183601523565557021494387782296223306652",
"246895445983223103553372279174506120206",
"168925601655666741467613186726577150070",
"126317871649652390698727667841572017061",
"310831581832565483553297791644518688982",
"300227488306954389795005666746903127257",
"266289564303676263936601836723059048117",
"128617917835707781311418929222851562532",
"260071700992553457056255028041069805342",
"337689135473945075770988223838412030247",
"113560140403428559204779370970324661540",
"279480763140229773430435579102834739419",
"87720114506446220307343541714248942612",
"59821366985637439649480634800270194442",
"116227016467288375826156061382987008880",
"39232440061799637305904250512097171106",
"260071700992553457056255028041069805342",
"251910443136377292985814058442059709248",
"330701182532069289297519444968719098037",
"27943770420124131459941947055302865860",
"208349371230863088102516993223006545067",
"34013764633926567765940121591139522987",
"205458958021568015827895469800436370426",
"254744154696527416520820160201981439753",
"221330674084280351496219524765436979963",
"210760430653364983927671232184448395678",
"138804345171706363814250650671970589695",
"6288240912548341047240246043452902382",
"136271905785010097445242362573447386120",
"247573291868633480241691565520823071285",
"8369271529053547230182444811638253433",
"87316013584723104113595102758520982835",
"339566832804867730989615487593011612946"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-424ab081",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamFunctions.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"304220326986794039009960645421555271206",
"38730040725595358974204536378838991664",
"324229367666042595913090276776291308097",
"103666808951377972849057855147724467329"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-43847715",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/QuicConstants.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"244300536953939214888356072019597927577",
"255489283181928711267647075719148556679",
"234747011678263751969763264041333887076",
"99860733498663438615040157774338891811",
"67635078041143233424321674495131077485",
"229071478357235822522021906937966885217",
"239702381846835329333633882465320024379",
"183479470189533361308541213421853638873",
"10324545446734500362246721410469774051",
"251248505296934618809775328361164914381"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-43dc3ba8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/server/test/QuicServerTransportTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "230916243290409270653305747065532515856",
"length": 698
},
"id": "CVE-2026-119234-46bf1c2b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamFunctions.cpp",
"function": "pushToTail"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41190058304417712333350467727019324960",
"length": 460
},
"id": "CVE-2026-119234-48dcdcda",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/test/QuicStreamFunctionsTest.cpp",
"function": "readBufferShape"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "39254118600132264015079997627126479482",
"length": 679
},
"id": "CVE-2026-119234-4a2ff4a0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/server/handshake/ServerHandshake.cpp",
"function": "ServerHandshake::doHandshake"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "217586562070744752361670792124029548917",
"length": 484
},
"id": "CVE-2026-119234-594f9393",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/client/QuicClientTransport.cpp",
"function": "QuicClientTransport::readWithRecvmmsg"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "167935431613265112555482510388829988947",
"length": 536
},
"id": "CVE-2026-119234-5a4c18dd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/api/QuicBatchWriter.cpp",
"function": "SendmmsgInplacePacketBatchWriter::append"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"179900156451657859057425080067264846293",
"79659078777170404222982082139536161125",
"36089561068559523439017743201087929895",
"22719985037160143916630529046284703791",
"100533613779895953905426414367020447765",
"270128164579061355938376126561929877806"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-5cfee485",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/api/test/QuicTransportBaseTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"159304694581112312173507399698854646427",
"101830465785076309146629586082897804431",
"307491450173078117944175734168870767133",
"52332679135016515742447090426830770762",
"85362526700203533139798497017257478351",
"124203818406736986023463440763230470188",
"249241621800382994278080465846563014243",
"97388499469740764842280433246671234857"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-5d1e4205",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/api/QuicBatchWriter.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "188749163778230518063558452317117864915",
"length": 550
},
"id": "CVE-2026-119234-61ce8076",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/test/QuicStreamFunctionsTest.cpp",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"241287892842306386813156125904655261680",
"55338332683482168222234298724506922004",
"23653495792688331861039402157371391783",
"193686206377436575990544572143145555872",
"160598127751510657336779983640342566301",
"231896613607450665334227576178897626640",
"320419027217989401291951015199379881296"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-659b7dc1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamManager.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"100021763284365514021931124847948596720",
"68750156886151483930534861942417401983",
"91869410714309949770868308094984146687",
"276453375393535318745178025251109565687",
"76614359540978121317388947712719803322",
"169198508010157687298561755800160378838",
"283347515554558080039361727033399713296",
"191670434421275739039727482363080706099",
"266170808162527027682061003704482786844",
"951063929099532741099674035801262209",
"324088041561811996410903087636323387742"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-6a5db9a2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/server/handshake/test/ServerHandshakeTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"307138389604428102488386460986269523985",
"248901130094671406404260425550621207470",
"181404577676393374725446180023158899038",
"206056034169063075653418572338974291519"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-6c138966",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamFunctions.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209687624047274607944913132254116417290",
"length": 1555
},
"id": "CVE-2026-119234-76dd71fe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/server/handshake/ServerHandshake.cpp",
"function": "ServerHandshake::processActions"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206290773323508341398853862829664516541",
"length": 445
},
"id": "CVE-2026-119234-7b8cd74a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/client/QuicClientTransport.cpp",
"function": "QuicClientTransport::readWithRecvmsg"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "321913470054212348001282907727260079761",
"length": 716
},
"id": "CVE-2026-119234-7cdd2a85",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/test/QuicStreamFunctionsTest.cpp",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"325743950747894668380737354713905370734",
"55487384951278491472734499977697200727"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-82925a88",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/stream/test/StreamStateFunctionsTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172251140016189201501132208931765325427",
"183410790617600243551408867994121022144",
"59375339079710792075643703060035991285",
"168599969613236577361491224498357411303"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-87bfd69c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/server/handshake/ServerHandshake.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287307784132836496116716998474179415307",
"length": 310
},
"id": "CVE-2026-119234-8a59bd25",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamFunctions.cpp",
"function": "processTxStopSending"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"73389532865519299107669248126039434442",
"131731126451818170239241164390881634573",
"330299094778884738581711962932313516305",
"230257779459573430949362446128350074472",
"238529390871831055403985017878506163683",
"130025187850493146395499557371544254189",
"281022793939499165120147927611186159077",
"267547598218360825195949920011645237500"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-8b8653b8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/stream/StreamStateFunctions.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "83210215617367533927213281574024967569",
"length": 301
},
"id": "CVE-2026-119234-8f46fbb6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/api/QuicBatchWriter.cpp",
"function": "SendmmsgPacketBatchWriter::append"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "303839707602496343534065687956381963857",
"length": 880
},
"id": "CVE-2026-119234-93e40011",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/api/QuicTransportBaseLite.cpp",
"function": "QuicTransportBaseLite::updateReadLooper"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"190515947370815280930421781510828776789",
"122123338344081974938086150355272117282",
"49770519263547865371325111306602890958",
"212109359505987258770023755268066592514"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-993cacba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/common/BufUtil.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "181130630721111142196337605612435582292",
"length": 3454
},
"id": "CVE-2026-119234-9ad5ded6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamManager.cpp",
"function": "QuicStreamManager::QuicStreamManager"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155657546435448143352655733709081665541",
"210516037047118523111787213116984638840",
"66688167367010994449118698319267184677",
"46965370143667768294566755019007755512",
"327268446016237929103952785242069983704",
"109604580269345132188544908332425739235",
"54170786026274001470731330785970258749",
"19629162492494877044568492802630067398",
"141372878231316105420428761906589836062",
"211766279514593320745745855669964197740",
"257421956244549374540636162819060506404",
"137196060203543060023148552283242813095",
"225192407020672659157032450085989214657",
"274348219927748117158876313972985551539",
"196382310496348643407808201655732220827",
"65251699844514124450204002213209431548",
"15174619644335565817069038840908275344",
"169092724925044606138582053071186838466",
"240342642176554263401986056532333465359",
"40031170346202434199197123640630041562",
"133439769483651506398600925842406917172",
"41034461842301765436690129040447589527",
"129250793444412409654865453148772141552",
"190979650980044665950327196448277886052",
"37789075087333407653904131723437814571",
"123790881286899490428060884244773360409",
"322096002111014698052363667182670107127",
"20254950814494506742819070645437012458",
"63532062404343389952402549082508872930",
"309146880023459534720515121977325318986",
"266341634764120794767634341923648102840",
"7538020603723955509839812457626966267",
"278218811025783341969050244593955459161",
"149250710168733798331268316343175956706",
"172281953363075486695964278823870993773",
"231022149012326364970856935638187836239",
"190979650980044665950327196448277886052",
"37789075087333407653904131723437814571",
"27010381555377609473267158239010742298",
"224625259351097466238585248958850863606",
"278409125272048890874323934767124218022",
"253877949137870869907550003588226677923",
"309146880023459534720515121977325318986",
"266341634764120794767634341923648102840",
"201563585937675001913709327288988092896",
"247902523012979070807073234076171209873",
"278646339356152189770650596488420098588",
"93163207333470882191207452487561995054",
"190979650980044665950327196448277886052",
"136363868802517016303607115996479141548",
"334549635911117554597652087569879536243",
"184932388600891514134046892314622787052",
"99945604085083192863739557434804309918",
"119419716094053136747916000431955715893",
"9754996882787524293979116361323464743",
"258784903152404367341963953006067449462",
"278849830631775459938262526740818462904",
"307290501762426236975230285142660006194",
"296801341988621241521907430825324551511",
"333771009152019467822483971548487312759",
"105041690266514391735211556729816616772",
"139326051416861616351146978370198784157",
"52749482641868103504016723654083429553",
"84464346176075251458577212348034412555",
"85676901952370636548143597291351660083",
"160284583549360403711462530714359844876",
"273550412194007467684024000402119643503",
"6560888468316213099845912951730298747",
"302498319736879013309525852358216530835",
"193066044730471703199155665254930596157",
"131097722829410650708724055452867255262",
"309967723660835536651540459239225356644",
"131286905487930808589326120292239501883",
"290694762578211169324212419195405712996",
"265758810945775848125618417065913317491",
"72479534788071523563017045710570755298"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-a109c1bb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/test/QuicStreamFunctionsTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "244218159119026207204306409849862523032",
"length": 2183
},
"id": "CVE-2026-119234-b2005076",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/server/test/QuicServerTransportTest.cpp",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "317755108304475897737801883224112207108",
"length": 819
},
"id": "CVE-2026-119234-b3c9c88e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/server/handshake/test/ServerHandshakeTest.cpp",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"227628619414859261847411332849827857876",
"183722561726432675653265082312820090139",
"50539320132016689740183000846677860921",
"106047690898790660410340177161769218538",
"72428962098989751507134439725674616498",
"327633989180691222565918689954440179453",
"315119325949719286165647425778149352396",
"185308740905125311094716054692223020453",
"299376931264038512501003459580934065747",
"222591327722043190718490869880389988001",
"75357005113548408821109689476372665677",
"78934788376575869143990339726855182400",
"173076099688884903710473027858054556733"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-bf9a604f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamManager.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "152857897494058210691349746313544917988",
"length": 445
},
"id": "CVE-2026-119234-bfbeb1f2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/api/QuicGsoBatchWriters.cpp",
"function": "GSOPacketBatchWriter::append"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "20038100394372529568172437216376943162",
"length": 856
},
"id": "CVE-2026-119234-c3ba5953",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/test/QuicStreamFunctionsTest.cpp",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "145959750714456074150514548556218019735",
"length": 334
},
"id": "CVE-2026-119234-c960ada5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/stream/StreamStateFunctions.cpp",
"function": "retireIngress"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"15504696653242880006172886938190280215",
"167906377625753944361093848695931227585",
"222910678502692750807992696069409572144",
"104514360724910082558791056884835352645"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-cb78fd84",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/api/QuicGsoBatchWriters.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "253099072282207845318372128566058483571",
"length": 1436
},
"id": "CVE-2026-119234-cf6bed7d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/client/QuicClientTransport.cpp",
"function": "QuicClientTransport::readWithRecvmmsgWrapper"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"76310356253565037297725838670414325537",
"269397026268917270295924167202330838838",
"213992801032697634595782362348416185836"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-cfe3ecd2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/test/QuicStreamManagerTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "243820828900165661007538303206174466512",
"length": 2116
},
"id": "CVE-2026-119234-d1ff65e2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/stream/StreamStateFunctions.cpp",
"function": "onResetQuicStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"148154987050969472072597491668197745520",
"296930668730259876157187760409140810935",
"216953224538081850830288845373607075843",
"285417876488192957803813115510586544165",
"304881428560849928274268340165951289375",
"75216220815472612407772874696301046598",
"48077542505172849350998795846944035551",
"337769105800032590165085033196235683045",
"71747410606964794934108167622576630314",
"327704143034122326750391950032038807640",
"193821799076480932685583667521133451700",
"308546011397481261049503071409297425373",
"323273070497558150204912377106070674485",
"213271752600440301735072314371923296547"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-d5e02fbe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/server/handshake/ServerHandshake.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "50470122300256524783471803395634471360",
"length": 491
},
"id": "CVE-2026-119234-d850cbf2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/QuicStreamFunctions.cpp",
"function": "appendDataToReadBuffer"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "288856332048961195481042126578227762191",
"length": 581
},
"id": "CVE-2026-119234-e46273b2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/state/test/QuicStreamFunctionsTest.cpp",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"203460977570513806428024416022134704750",
"7489823220868263992829930314742290253",
"18402823475475695156114009722439343626",
"129772735668619129205394519234916468331",
"270452030192760134773305364901260258082",
"7489823220868263992829930314742290253",
"18402823475475695156114009722439343626",
"129772735668619129205394519234916468331",
"270452030192760134773305364901260258082",
"7489823220868263992829930314742290253",
"18402823475475695156114009722439343626",
"129772735668619129205394519234916468331"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-e91beca7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d",
"target": {
"file": "quic/client/QuicClientTransport.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"256183629578542931176892905665335827097",
"126305054921605979874562401678396019318",
"18252638165613331032599620344642689685"
],
"threshold": 0.9
},
"id": "CVE-2026-119234-f7771504",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44",
"target": {
"file": "quic/common/BufUtil.h"
}
}
]
vanir_signatures_modified
"2026-11-14T13:28:01Z"