CVE-2026-119235

proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and...

CVE-2026-119235

proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and...

CVE-2026-119235

The proxygen HTTP/3 stack contains a vulnerability in its QPACK decoder . The decoder fails to enforce size limits on string literals in encoder-stream instructions until the entire literal is received. A remote, unauthenticated HTTP/3 peer can exploit this by sending an insert instruction with a...

CVE-2026-119235

proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and...

EUVD-2026-123605

proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and...

CVE-2026-119235: Facebook proxygen: proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the…

proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and...

PT-2026-145270

proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and...

Netty QpackDecoder DoS

The vulnerability of the io.netty.handler.codec.http3.QpackDecoder component in the Netty framework, which is used for developing network applications, servers, and clients, involves unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service...

Netty QpackDecoder DoS

The vulnerability of the io.netty.handler.codec.http3.QpackDecoder component in the Netty framework, which is used for developing network applications, servers, and clients, involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service...

Netty QpackDecoder DoS

The vulnerability of the io.netty.handler.codec.http3.QpackDecoder component in the Netty framework, which is used for developing network applications, servers, and clients, involves unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in shouldWaitForDynamicTableUpdates in QpackDecoder. An attacker can open an indefinite number of persistently blocked streams by sending headers that reference dynamic table entries...

CVE-2026-42582

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specially crafted compressed field section during header block decoding. This flaw occurs because the system allocates a new byte array based on ...

CVE-2026-42582

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoderdecodeHuffmanEncodedLiteral may execute new bytelength for a string literal before verifying that length byt...

CVE-2026-42582 Netty: HTTP/3 QPACK literal unbounded allocation

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoderdecodeHuffmanEncodedLiteral may execute new bytelength for a string literal before verifying that length byt...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the decodeHuffmanEncodedLiteral function in the QPACK decoder, which allocates memory for a byte array based on a length value received from the network without verifying that sufficie...