In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
|
No data.
No data.
References
History
Thu, 01 Oct 2026 04:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Use-after-free in Facebook proxygen HTTP stream handlers |
Wed, 30 Sep 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Mon, 28 Sep 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Facebook
Facebook proxygen |
|
| Vendors & Products |
Facebook
Facebook proxygen |
Mon, 28 Sep 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Use-after-free in Facebook proxygen HTTP stream handlers | |
| Weaknesses | CWE-416 |
Mon, 28 Sep 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Meta
Published: 2026-09-28T20:44:45.928Z
Updated: 2026-09-30T19:49:15.429Z
Reserved: 2026-09-14T18:40:39.036Z
Link: CVE-2026-91095
Vulnrichment
Updated: 2026-09-30T19:48:58.524Z
NVD
Status : Deferred
Published: 2026-09-28T21:17:19.170
Modified: 2026-09-30T20:17:36.470
Link: CVE-2026-91095
Redhat
No data.