CVE-2026-91095

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which...

CVE-2026-91095

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which...

PT-2026-102368

Name of the Vulnerable Software and Affected Versions proxygen versions 2024.10.28.00 through 2026.09.28.00 Description A use-after-free issue exists where the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs may return stream handles that have already...