CVE-2026-91095

5.3 Moyenne

Publiée le 28/09/2026 à 23:17 · Modifiée le 30/09/2026 à 22:17 · Analyse NVD reportée · Source : cve-assign@fb.com

Description

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.

Traduire en français

Produits concernés

Facebook proxygen

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

Faiblesses (CWE)

CWE-416

Références

https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083
https://www.facebook.com/security/advisories/cve-2026-91095

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories