CVE-2026-44909

A flaw was found in Proxygen. A remote, unauthenticated attacker could exploit a missing slow-consumer detection mechanism in the HTTP/2 protocol. By manipulating HTTP/2 flow-control settings, an attacker can force the server to buffer large amounts of data in memory indefinitely. This can lead t...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

EUVD-2026-48310

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

PT-2026-64025

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS INITIAL WINDOW SIZE to 0 or withholding WINDOW UPDATE frames, causing the server to buffer complete response...