CVE-2026-119237
- Source
- https://cve.org/CVERecord?id=CVE-2026-119237
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119237.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-119237
- Published
- 2026-11-11T17:17:16Z
- Modified
- 2026-11-14T07:06:07Z
- Summary
- [none]
- Details
-
In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit, returned flow-control credit to the peer, and was re-scanned in full on every read. With QPACK blocked streams enabled (the default), a remote, unauthenticated HTTP/3 peer could send a HEADERS block that references a dynamic table insert it never sends, followed by a continuous stream of data, causing memory growth until the request timed out and CPU usage that grows quadratically, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00.
- References
Affected packages
Git / github.com/meta/proxygen
Affected ranges
- Type
- GIT
- Repo
- https://github.com/meta/proxygen
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "2026.11.09.00" } ], "source": "DESCRIPTION" }, { "range": [ { "fixed": "daf245bba7fe1304b9491403fe56f91153299781" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v0.*
v0.18.0
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.32.0
v2017.*
v2017.01.16.00
v2017.01.23.00
v2017.01.30.00
v2017.03.06.00
v2017.03.13.00
v2017.03.20.00
v2017.03.27.00
v2017.04.03.00
v2017.04.10.00
v2017.04.17.00
v2017.04.24.00
v2017.05.01.00
v2017.05.08.00
v2017.05.15.00
v2017.05.22.00
v2017.05.29.00
v2017.06.05.00
v2017.06.12.00
v2017.06.19.00
v2017.06.26.00
v2017.07.03.00
v2017.07.10.00
v2017.07.17.00
v2017.07.24.00
v2017.07.31.00
v2017.08.07.00
v2017.08.14.00
v2017.08.21.00
v2017.08.28.00
v2017.09.04.00
v2017.09.11.00
v2017.09.18.00
v2017.09.25.00
v2017.10.02.00
v2017.10.09.00
v2017.10.16.00
v2017.10.23.00
v2017.10.30.00
v2017.11.06.00
v2017.11.13.00
v2017.11.20.00
v2017.11.27.00
v2017.12.04.00
v2017.12.11.00
v2017.12.18.00
v2017.12.25.00
v2018.*
v2018.01.01.00
v2018.01.08.00
v2018.01.15.00
v2018.01.22.00
v2018.01.29.00
v2018.02.05.00
v2018.02.12.00
v2018.02.19.00
v2018.02.26.00
v2018.03.05.00
v2018.03.12.00
v2018.03.19.00
v2018.03.26.00
v2018.04.02.00
v2018.04.09.00
v2018.04.16.00
v2018.04.23.00
v2018.04.30.00
v2018.05.07.00
v2018.05.14.00
v2018.05.21.00
v2018.05.28.00
v2018.06.04.00
v2018.06.11.00
v2018.06.18.00
v2018.06.25.00
v2018.07.02.00
v2018.07.09.00
v2018.07.16.00
v2018.07.23.00
v2018.07.30.00
v2018.08.06.00
v2018.08.13.00
v2018.08.20.00
v2018.08.27.00
v2018.09.03.00
v2018.09.10.00
v2018.09.17.00
v2018.09.24.00
v2018.10.01.00
v2018.10.08.00
v2018.10.15.00
v2018.10.22.00
v2018.10.29.00
v2018.11.05.00
v2018.11.12.00
v2018.11.19.00
v2018.11.26.00
v2018.12.03.00
v2018.12.10.00
v2018.12.17.00
v2018.12.24.00
v2018.12.31.00
v2019.*
v2019.01.07.00
v2019.01.14.00
v2019.01.21.00
v2019.01.28.00
v2019.02.04.00
v2019.02.11.00
v2019.02.18.00
v2019.02.25.00
v2019.03.04.00
v2019.03.18.00
v2019.03.25.00
v2019.04.01.00
v2019.04.08.00
v2019.04.15.00
v2019.04.22.00
v2019.04.29.00
v2019.05.06.00
v2019.05.13.00
v2019.05.20.00
v2019.05.27.00
v2019.06.03.00
v2019.06.10.00
v2019.06.17.00
v2019.06.24.00
v2019.07.01.00
v2019.07.08.00
v2019.07.15.00
v2019.07.22.00
v2019.07.29.00
v2019.08.05.00
v2019.08.12.00
v2019.08.19.00
v2019.08.26.00
v2019.09.02.00
v2019.09.09.00
v2019.09.16.00
v2019.09.23.00
v2019.09.30.00
v2019.10.07.00
v2019.10.14.00
v2019.10.21.00
v2019.10.28.00
v2019.11.04.00
v2019.11.11.00
v2019.12.02.00
v2019.12.06.00
v2019.12.09.00
v2019.12.16.00
v2019.12.23.00
v2019.12.30.00
v2020.*
v2020.01.06.00
v2020.01.13.00
v2020.01.20.00
v2020.01.27.00
v2020.02.03.00
v2020.02.10.00
v2020.02.17.00
v2020.02.24.00
v2020.03.02.00
v2020.03.09.00
v2020.03.16.00
v2020.03.23.00
v2020.03.30.00
v2020.04.06.00
v2020.04.13.00
v2020.04.20.00
v2020.04.27.00
v2020.05.04.00
v2020.05.11.00
v2020.05.18.00
v2020.05.25.00
v2020.06.01.00
v2020.06.08.00
v2020.06.15.00
v2020.06.29.00
v2020.07.06.00
v2020.07.13.00
v2020.07.20.00
v2020.07.27.00
v2020.08.03.00
v2020.08.10.00
v2020.08.17.00
v2020.08.24.00
v2020.08.31.00
v2020.09.07.00
v2020.09.14.00
v2020.09.21.00
v2020.09.28.00
v2020.10.05.00
v2020.10.12.00
v2020.10.19.00
v2020.10.26.00
v2020.11.02.00
v2020.11.09.00
v2020.11.16.00
v2020.11.23.00
v2020.11.30.00
v2020.12.07.00
v2020.12.14.00
v2020.12.21.00
v2020.12.28.00
v2021.*
v2021.01.04.00
v2021.01.11.00
v2021.01.18.00
v2021.01.25.00
v2021.02.01.00
v2021.02.08.00
v2021.02.15.00
v2021.02.22.00
v2021.03.01.00
v2021.03.15.00
v2021.03.22.00
v2021.03.29.00
v2021.04.05.00
v2021.04.12.00
v2021.04.19.00
v2021.04.26.00
v2021.05.03.00
v2021.05.10.00
v2021.05.17.00
v2021.05.24.00
v2021.05.31.00
v2021.06.07.00
v2021.06.14.00
v2021.06.21.00
v2021.06.28.00
v2021.07.05.00
v2021.07.12.00
v2021.07.19.00
v2021.07.20.00
v2021.07.22.00
v2021.08.02.00
v2021.08.23.00
v2021.08.30.00
v2021.09.06.00
v2021.09.13.00
v2021.09.20.00
v2021.09.27.00
v2021.10.04.00
v2021.10.11.00
v2021.10.18.00
v2021.10.25.00
v2021.11.01.00
v2021.11.08.00
v2021.11.15.00
v2021.11.29.00
v2021.12.06.00
v2021.12.13.00
v2021.12.20.00
v2021.12.27.00
v2022.*
v2022.01.03.00
v2022.01.10.00
v2022.01.17.00
v2022.01.24.00
v2022.01.31.00
v2022.02.07.00
v2022.02.14.00
v2022.02.21.00
v2022.02.28.00
v2022.03.07.00
v2022.03.14.00
v2022.03.21.00
v2022.03.28.00
v2022.04.04.00
v2022.04.11.00
v2022.04.18.00
v2022.04.25.00
v2022.05.02.00
v2022.05.09.00
v2022.05.16.00
v2022.05.23.00
v2022.05.30.00
v2022.06.06.00
v2022.06.13.00
v2022.06.20.00
v2022.06.27.00
v2022.07.04.00
v2022.07.11.00
v2022.07.18.00
v2022.07.25.00
v2022.08.01.00
v2022.08.08.00
v2022.08.15.00
v2022.08.22.00
v2022.08.29.00
v2022.09.05.00
v2022.09.12.00
v2022.09.19.00
v2022.09.26.00
v2022.10.03.00
v2022.10.10.00
v2022.10.17.00
v2022.10.24.00
v2022.10.31.00
v2022.11.07.00
v2022.11.14.00
v2022.11.28.00
v2022.12.05.00
v2022.12.12.00
v2022.12.19.00
v2022.12.26.00
v2023.*
v2023.01.02.00
v2023.01.09.00
v2023.01.16.00
v2023.01.23.00
v2023.01.30.00
v2023.02.06.00
v2023.02.13.00
v2023.02.20.00
v2023.02.27.00
v2023.03.06.00
v2023.03.13.00
v2023.03.20.00
v2023.03.27.00
v2023.04.03.00
v2023.04.10.00
v2023.04.17.00
v2023.04.24.00
v2023.05.01.00
v2023.05.08.00
v2023.05.15.00
v2023.05.22.00
v2023.06.08.00
v2023.06.12.00
v2023.06.19.00
v2023.06.26.00
v2023.07.03.00
v2023.07.10.00
v2023.07.17.00
v2023.07.24.00
v2023.07.31.00
v2023.08.07.00
v2023.08.14.00
v2023.08.28.00
v2023.09.04.00
v2023.09.11.00
v2023.09.18.00
v2023.09.25.00
v2023.10.02.00
v2023.10.09.00
v2023.10.16.00
v2023.10.23.00
v2023.10.30.00
v2023.11.06.00
v2023.11.13.00
v2023.11.20.00
v2023.11.27.00
v2023.12.04.00
v2023.12.11.00
v2023.12.18.00
v2023.12.25.00
v2024.*
v2024.01.01.00
v2024.01.08.00
v2024.01.15.00
v2024.01.22.00
v2024.01.29.00
v2024.02.05.00
v2024.02.12.00
v2024.02.19.00
v2024.02.26.00
v2024.03.04.00
v2024.03.11.00
v2024.03.18.00
v2024.03.25.00
v2024.04.01.00
v2024.04.08.00
v2024.04.15.00
v2024.04.22.00
v2024.04.29.00
v2024.05.02.00
v2024.05.06.00
v2024.05.13.00
v2024.05.20.00
v2024.05.27.00
v2024.06.03.00
v2024.06.10.00
v2024.06.17.00
v2024.06.24.00
v2024.07.01.00
v2024.07.08.00
v2024.07.15.00
v2024.07.22.00
v2024.07.29.00
v2024.08.05.00
v2024.08.12.00
v2024.08.19.00
v2024.08.26.00
v2024.09.02.00
v2024.09.09.00
v2024.09.16.00
v2024.09.23.00
v2024.09.30.00
v2024.10.07.00
v2024.10.14.00
v2024.10.21.00
v2024.10.28.00
v2024.11.04.00
v2024.11.11.00
v2024.11.18.00
v2024.11.25.00
v2024.12.02.00
v2024.12.09.00
v2024.12.16.00
v2024.12.23.00
v2024.12.30.00
v2025.*
v2025.01.06.00
v2025.01.13.00
v2025.01.20.00
v2025.01.27.00
v2025.02.03.00
v2025.02.10.00
v2025.02.17.00
v2025.02.24.00
v2025.03.03.00
v2025.03.10.00
v2025.03.17.00
v2025.03.24.00
v2025.03.31.00
v2025.04.07.00
v2025.04.14.00
v2025.04.21.00
v2025.04.28.00
v2025.05.05.00
v2025.05.12.00
v2025.05.19.00
v2025.05.26.00
v2025.06.02.00
v2025.06.09.00
v2025.06.16.00
v2025.06.23.00
v2025.06.30.00
v2025.07.07.00
v2025.07.14.00
v2025.07.21.00
v2025.07.28.00
v2025.08.04.00
v2025.08.11.00
v2025.08.18.00
v2025.08.25.00
v2025.09.01.00
v2025.09.08.00
v2025.09.15.00
v2025.09.22.00
v2025.09.29.00
v2025.10.06.00
v2025.10.13.00
v2025.10.20.00
v2025.10.27.00
v2025.11.03.00
v2025.11.10.00
v2025.11.17.00
v2025.11.24.00
v2025.12.01.00
v2025.12.02.00
v2025.12.15.00
v2025.12.22.00
v2025.12.29.00
v2026.*
v2026.01.05.00
v2026.01.12.00
v2026.01.19.00
v2026.01.26.00
v2026.02.02.00
v2026.02.09.00
v2026.02.16.00
v2026.02.23.00
v2026.03.02.00
v2026.03.09.00
v2026.03.16.00
v2026.03.23.00
v2026.03.30.00
v2026.04.06.00
v2026.04.13.00
v2026.04.20.00
v2026.04.27.00
v2026.05.04.00
v2026.05.11.00
v2026.05.18.00
v2026.05.25.00
v2026.06.01.00
v2026.06.08.00
v2026.06.15.00
v2026.06.22.00
v2026.06.29.00
v2026.07.06.00
v2026.07.13.00
v2026.07.20.00
v2026.07.27.00
v2026.08.03.00
v2026.08.10.00
v2026.08.17.00
v2026.08.24.00
v2026.08.31.00
v2026.09.07.00
v2026.09.14.00
v2026.09.21.00
v2026.09.28.00
v2026.10.05.00
v2026.10.12.00
v2026.10.19.00
v2026.10.26.00
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119237.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"15034696452393211841554768339451873203",
"208994346614362991279822127446486830535",
"274306907101058158645269473373987980471",
"158238559822750169715013775130111502368",
"151182585805184299005336160728819688451",
"255636853528261707576049265355365963658",
"8104838092709710033032039945157147442"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-00114310",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/test/HQUpstreamSessionTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"120832210217008204836929388756514645713",
"159252836740926369277629891281701458093",
"333497881097752720651663984045673532143",
"70880031654253939927984855275930767635",
"162807726032668408982064363330342221596",
"64917593198942059291694904574233649449",
"317932258924868199556618857736548251543",
"334603663475825659085886200816285279930",
"223382478532419730663943772010867117841",
"167761590949481307043995465779425574633",
"97437668755309452765214511989157650563",
"332555766415751250715510052133614188542"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-066c888a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f",
"target": {
"file": "proxygen/lib/http/codec/CodecProtocol.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"287001967412217098684942290369719797949",
"237872624600714707219241888303262109311",
"243933686684997671109000521393769353301",
"149105204139915179548261683295717838084",
"269521037402280809290562557586858631905",
"98844320299112489522502320625183295536",
"289513442774888620851153565618322273643",
"243680836823114681615673443819198296465",
"227534935142233712894307241190839302375",
"274525032746363302937206061235979785167",
"60292213620216227282785687663636767486",
"65239146081331835785394003911369108619",
"6899282088322200694362392710694028356"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-091ac258",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/compress/QPACKDecoder.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"265711761104519347277227115816002992366",
"54892006895636261037347289204119361361",
"158088364005043190638776825223043850272",
"41563016314375245028820693639900290299",
"52800034147685568674182387141456586746",
"207210832092338079484920636160798897861",
"184282822346797199488937993833802167149",
"155211047298646513307493625259592823069",
"183114251480494516783272189397212733704",
"300510567374350172433622580443914681549",
"200631720477732093720648232322288787780",
"151010157494970858070719498202439842993",
"179719236570132225225638568346316861418",
"255891987415122473171266570122129643348",
"33302757671262361576562556974441532026",
"275141671524694272399191714039162532307",
"204390478324635094376768506062140913943"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-1aff9db3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/test/HQCodecTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325402957006615756555670716191282297517",
"length": 1181
},
"id": "CVE-2026-119237-2acd9e12",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/compress/HPACKDecodeBuffer.cpp",
"function": "HPACKDecodeBuffer::decodeLiteral"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"96966570320052621831406393455846448412",
"143275295886896234662816618570975721554",
"339431619489076674361650038658648994985",
"206221176283277338109420245735815081108",
"250064693292786324715833489870495446303",
"220568849484258034636347125696091751984"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-31f907e6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/HQStreamCodec.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "111158673403414875753748686220214479093",
"length": 782
},
"id": "CVE-2026-119237-3e1dfa32",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f",
"target": {
"file": "proxygen/lib/http/codec/CodecProtocol.cpp",
"function": "serverAcceptedUpgrade"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "221568850615610200701991242945273129912",
"length": 268
},
"id": "CVE-2026-119237-4e5a0a0f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp",
"function": "HQSession::resumeReads"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "302746580116567703709293970729565343262",
"length": 3067
},
"id": "CVE-2026-119237-4e7cab25",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp",
"function": "HQSession::HQStreamTransportBase::onHeadersComplete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "311003059372496172768746897583919653067",
"length": 1706
},
"id": "CVE-2026-119237-56a31e59",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp",
"function": "HQSession::HQStreamTransportBase::onError"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "190377351879847535831805923577696856146",
"length": 2522
},
"id": "CVE-2026-119237-5b1e50e7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/HQFramedCodec.cpp",
"function": "HQFramedCodec::onFramedIngress"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"103678433281190198118171387768567502371",
"268948592876150993162450674411262078161",
"144334804806277610028018624246878816273"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-65d34c50",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/coro/test/HTTPDownstreamCoroSessionTests.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"161164760423200231512550607833656979702",
"214133428852083202025273119550177696782",
"184292156082261461124250087159340912527",
"140344860192762763754050543247265915402",
"90387822815796978355614377896423732735",
"127836922660475367557178819070616580877",
"294610807192964461107747537270380050590",
"158636533068045620634699994934709551278"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-67931899",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/coro/HTTPCoroSession.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209015504572731264237632493680306863017",
"length": 1121
},
"id": "CVE-2026-119237-6912642d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/HQFramedCodec.cpp",
"function": "HQFramedCodec::parseFrame"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "135004055046642845355867781534296428729",
"length": 312
},
"id": "CVE-2026-119237-73dfacfc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/coro/HTTPCoroSession.cpp",
"function": "HTTPCoroSession::resetOpenStreams"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "333993192566343569348016129672636814173",
"length": 188
},
"id": "CVE-2026-119237-7954e97c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp",
"function": "HQSession::resumeReads"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115484644457990704286876614324969094998",
"length": 473
},
"id": "CVE-2026-119237-7b40a583",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/test/HQDownstreamSessionTest.cpp",
"function": "TEST_P"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"265194875211338502878009567027359929128",
"182056287176001771236059684980906694328",
"255166599260276495478373859549805645058",
"79482160528464330370453831348795385174",
"337905027233113547696521273854861284718",
"109370948819901109764678143400501406281",
"204487516539173877567077377823064165850",
"100645640887425275624448214043592454419",
"55929671363355560172856562916347247407",
"212303097328113326261462205354350652898",
"283360861187905051839747190629382243588",
"141028017462017802431054552768054707676",
"268886087866226998902332102187631505599"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-83b8e54e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/compress/HPACKDecodeBuffer.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"238529013326343877278991129352357524643",
"227920204734732082914316404549882112505",
"53447088959292226813293510305413775520",
"245532474185276155679437430902801347225"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-90f75d7c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/HQStreamCodec.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"231351884042265946860809917090203324576",
"137102956104882346008960217902877051947",
"23344192700825912429616617230267674908",
"205211788184107933652249686772058484055",
"184134869876781070424326021930923363750",
"157190664708256465356961680965217438603",
"131686119711051515999160380473114415073",
"232720626615781355200140362789087514999",
"186864427519449873094206205117918132322",
"184263563906305267907369490820355516579",
"312521738162539732589878553556386310778",
"257310540911225964514348660420799741744",
"97808484551154773624555208373411244707",
"54127396792960372578833582676137515895",
"270488952439598311086650609255281138540",
"106165769323625217212688860737457366163",
"86666852448713506249747711426841665241",
"6041214374138809883248000986360585960",
"194996897531412745952275535973865382453",
"170473484860343056779484888067445270896",
"97493072654464156939925039859094094760",
"119668700697571147732319404162635876591",
"121992365691087024018543351994914232216",
"280952471832160617791579997461519972534",
"75948803071768541535430971232341398516",
"228311876258154215436467657139083523379",
"95585082977766486578948437424384512502",
"237089707973951074310317306622683290235",
"283875209735479379825323736419352495827",
"117420394319655153855383117131566613347"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-922d7e42",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "243176297844324118179794704587620681109",
"length": 1861
},
"id": "CVE-2026-119237-a1107f2f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/compress/QPACKDecoder.cpp",
"function": "QPACKDecoder::decodeLiteralHeaderQ"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"312155550928927255893469703277168117988",
"248675243967843624643458598405024183969",
"179847879417664029073656960364731645261",
"245906313013601483436184520568558463086",
"181144524208149827146788135445906085529",
"110343948290209898197782169351671267910",
"22255121213860363754308742067466036169",
"292503812642743045050115086609598752769",
"125411119569222004795190799668909327575",
"127034901789409641374600108731738686850",
"154242359963032726907912587127331936498",
"76219342895628318717830310714228406187",
"41264377699339183930845119355778530576",
"34820532339038654751733407138666352717",
"236755422707747602155443276263316999065",
"68788116463241980996291900062125259675",
"69397966171340857351266929288066497463",
"48557193161680982182028241340322461578"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-a4868833",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f",
"target": {
"file": "proxygen/lib/http/HTTPMessage.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"306219039822168734648673640736506803107",
"101623106194266471933618908472160666351",
"44773911992587086442744793510620120239"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-b3d400ab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/compress/test/QPACKContextTests.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"18629590188575873428942784772222312760",
"334131797872692092779978404912365928003",
"139395786873620821017690787134486328846"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-c1cf6ce2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/test/HQDownstreamSessionTest.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "240785928022020584813835574434933258146",
"length": 1159
},
"id": "CVE-2026-119237-c2b5fa01",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/test/HQUpstreamSessionTest.cpp",
"function": "TEST_P"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"113806203052946113194428803355121634473",
"81799554579836300664746920201240004271",
"297450490686111204395104973799305063691",
"221086850303680611809109926487791120130",
"43460050797153147672692060898329127174",
"254124345353716176244876177793491803271",
"143633288569521338537780681907577365541",
"326443139636391086608187471729211774228",
"166432743547132533310176519012157109903",
"229578062008879367133039844891107592926",
"114463740357823617807920335703437663255",
"277098449388886517893632635887853670965",
"308701814867881620845543441895777256797",
"191897235294452925238042056960313775926",
"166210839608611050168050155486000626230",
"88654300159261741299189289289356726159",
"47668961855141768877893949754424577034",
"136805887782680805332271406144774413820",
"232181181075519320911183640213909270045",
"327663973234664113885808357895671392306",
"279581511424740506121080700003226672208",
"338523927605373046755153849635658117284",
"67044534825671385019618988261401795505",
"219847791138650783966246017203091032179",
"72786567075134789981872876967408393459",
"63197085037280672761261619737227590517",
"319525884610172342876902294021179717668",
"310153327731097614010396837287914821591",
"301919934510374427332992842148573871908",
"232839970309398886422259842177543858857",
"93629154327600513521687771191937942563",
"59754015839841415533055993987024785971",
"165375280741986519406584364995003291593",
"160203754356214441259497463568937609961",
"193782826099231750774659323426512787632",
"11776401016763583739215025936483012782",
"124903148717950879031274528003868147512",
"221608112779239682135385206484301644586",
"284975895391807861812087249060882886263",
"61121098812433399058982399349594329352",
"116253373356051213149753594220589655815",
"291324068965236365235911211472189580906",
"310064074024255843249051262065416679816",
"121281766859789046122197245250984548060",
"220891932407826579330465846494345012816",
"205624838294061204991737816640956422311",
"256770861806075418766849660432652464350",
"165367278138629740417609653387382055092",
"282581040689382196494469728419783021231",
"321712017153127324769372287944343235181",
"50886433039341969003152408546583196924",
"266314189557357984363924266591214837374",
"174897794123973076413853837671073353397",
"96049984329209610832612413999365161080",
"28420277373371569973444061321594103514",
"117441967083274303676909916980118651926",
"79081376372490393181753956597638438384"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-c450be90",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/HQFramedCodec.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"208699403997712542113703805166235540156",
"44937344481708976485463998735782996146",
"292966294185446678310785364817116991094",
"3490116130655899683212162121293026270",
"280064756223749662254434557384684906293",
"32481570581467945781911084535178013009",
"263961084022990270116094864029068724758",
"304068786725400431985776783315302384516",
"23930623389081448883071550052432179713",
"98337061100758625796611922347989656320",
"262786439605282993502599612249734023367",
"199347307930831607071471492745885677227",
"299257000026989466302744036003419605618",
"106812626895159574889998313939873417097",
"189959101725350703605214275540792572833",
"130206257354859316574418676839053730078"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-cbb94523",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/HQSession.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "42427938797419812805908060076325456622",
"length": 2053
},
"id": "CVE-2026-119237-d8fcd2ef",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/test/HQCodecTest.cpp",
"function": "qpackTest"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"28540781282860012090497403743475805418",
"7075047224141832112458172595594974409",
"56426454152518380346587885971786309624",
"83851390459640073109456941884975011108",
"125372405082601462211602327081611124956",
"985060381627456831808813746591427198",
"255398917104308844422524736857908727337",
"256275182324214577562060487047174180586",
"78522060048191852198821617687057720077",
"9669762096361892876942850273720097214",
"271696943468371960334389273058643495924",
"115232026535158015942455894727133003511",
"202663739105948037159955792139458373014",
"11598971029321488092007012780793125057",
"179165495508061001144163948773688922443",
"144128038894769275202752342352878459007",
"59028049359917559050142360009536965000"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-da1efa62",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/codec/HQFramedCodec.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "122770666403599124928422094142104325260",
"length": 785
},
"id": "CVE-2026-119237-ddac8a4e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp",
"function": "HQSession::HQStreamTransportBase::initCodec"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"227669475324487839766187766872341664757",
"184192760736917158679264329046762201803",
"11023238191459862037943363264158575462",
"178126099518797993717776224784624979086"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-ded87723",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f",
"target": {
"file": "proxygen/httpserver/samples/masque/MasqueClient.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"188304645056507728196755512158359072857",
"246694067129469066357770195298686857791",
"43979441029657633426912284755309368778",
"272458398859274135615033929829523781318",
"13564099680588233612918689912856448987",
"180990305846041504291771159781941364287",
"113650479705734737627864818782014541783"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-e20eb480",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/test/HQSessionTestCommon.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"26631180975222631569346219644770718437",
"82527020875030830703102966129510581967",
"124039816100421011610057218327843705619",
"87312310490147662812403196152656262500",
"169842685677156272488662868878246730466",
"33846132979610988196349542659335858008",
"145833571507394596956983303247254589443",
"329969673009363395841668049508462571321",
"318690021318339407097045177851511235914",
"233896465181738706499321488466891692707",
"279449412206872906884460477138547798605",
"139679714464040682807339359951722245608",
"117561968834163658646847064007710552186",
"203502341891936082882742946236296216332",
"320469525186466834954482294582857110184",
"94026016053001756692430244113521847988",
"25973054638391614856268943556634920284",
"259916494756285476272959179503692283403",
"269645539985011643701369749019676954064",
"201850928973058621869827777569147106100",
"267781685977541342228639827689189928674",
"102848196630890516373305477857958031817"
],
"threshold": 0.9
},
"id": "CVE-2026-119237-f522fb74",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781",
"target": {
"file": "proxygen/lib/http/session/test/HQDownstreamSessionTest.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "84378633117195407713217986281247997951",
"length": 2861
},
"id": "CVE-2026-119237-fdb835d6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f",
"target": {
"file": "proxygen/httpserver/samples/masque/MasqueClient.cpp",
"function": "main"
}
}
]
vanir_signatures_modified
"2026-11-14T07:06:07Z"