Overview 11 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
11matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
11
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
11
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
11
100.0%
split by
peak 3 / year
20173
Not applicable3
Critical1
High2
not blocked3
No public exploit3
20183
Not applicable3
High3
not blocked3
No public exploit3
20192
Not applicable2
Critical2
not blocked2
No public exploit2
20201
Not applicable1
Critical1
not blocked1
No public exploit1
20211
Not applicable1
High1
not blocked1
No public exploit1
20220
20230
20240
20251
Not applicable1
Medium1
not blocked1
No public exploit1
201720182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-55181 | Medium | 2025-12-02 | Not applicable | No public exploit | Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory. |
| CVE-2021-24029 | High | 2021-03-15 | Not applicable | No public exploit | A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00. |
| CVE-2020-1897 | Critical | 2020-05-18 | Not applicable | No public exploit | A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence. This issue affects versions of proxygen prior to v2020.05.18.00. |
| CVE-2019-11940 | Critical | 2019-12-04 | Not applicable | No public exploit | In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00. |
| CVE-2019-11921 | Critical | 2019-07-25 | Not applicable | No public exploit | An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00. |
| CVE-2018-6347 | High | 2018-12-31 | Not applicable | No public exploit | An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00. |
| CVE-2018-6346 | High | 2018-12-31 | Not applicable | No public exploit | A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen prior to v2018.12.31.00. |
| CVE-2018-6343 | High | 2018-12-31 | Not applicable | No public exploit | Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00. |
| CVE-2015-7265 | High | 2017-04-10 | Not applicable | No public exploit | Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. |
| CVE-2015-7264 | Critical | 2017-04-10 | Not applicable | No public exploit | The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks. |
| CVE-2015-7263 | High | 2017-04-10 | Not applicable | No public exploit | The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. |