# CVE-2026-119233: Meta proxygen HTTP/3 denial of service in frame buffering

Source: https://junglewise.ai/threats/cve-2026-119233-proxygen-s-http-3-codec-buffered-an-incomplete-non-data-frame  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-119233 · Severity: info · Published 2026-11-11

Meta's proxygen is a C++ HTTP library used to handle web communication protocols. An attacker can cause unbounded memory and CPU consumption by slowly sending an incomplete HTTP/3 frame with a very large declared size, leading to denial of service and potential service outages.

Technologies: [Meta Proxygen](https://junglewise.ai/threats/technologies/meta-proxygen). Vendors: [Meta](https://junglewise.ai/threats/vendors/meta).

## Quick answers

**Is CVE-2026-119233 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119233 being exploited in the wild.

**How severe is CVE-2026-119233?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Meta Proxygen before v2026.11.09.00.

**Is there a fix for CVE-2026-119233?** Yes: fixed in v2026.11.09.00. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119233 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119233?** Check whether you run Meta Proxygen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v2026.11.09.00

## Technical details

The HTTP/3 codec in proxygen lacks bounds checking when buffering incomplete non-DATA frames (control-stream, HEADERS, or unknown frame types) and rescans all buffered data on each incoming byte fragment, causing quadratic CPU growth. A remote, unauthenticated attacker on the network can trigger this via a single HTTP/3 connection by declaring a massive frame length and delivering it slowly in small fragments. The vulnerability affects proxygen before v2026.11.09.00.

## Affected products

- Meta proxygen before v2026.11.09.00

## Timeline

- 2026-11-11: disclosed
- 2026-11-09: patched

## References

- [https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781](https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781)
- [https://www.facebook.com/security/advisories/cve-2026-119233](https://www.facebook.com/security/advisories/cve-2026-119233)

## Related threats

- [Meta proxygen use-after-free in HTTP session handling](https://junglewise.ai/threats/cve-2026-121737-when-a-remote-unauthenticated-http-1-1-client-pipelined-the)
- [Meta proxygen HTTP/3 denial of service in QPACK handling](https://junglewise.ai/threats/cve-2026-119237-in-proxygen-s-http-3-session-when-a-headers-block-referenced)
- [proxygen QPACK decoder unbounded buffering denial of service](https://junglewise.ai/threats/cve-2026-119235-proxygen-s-qpack-decoder-enforced-its-size-limit-on-a-string)
- [Meta proxygen use-after-free in stream cleanup](https://junglewise.ai/threats/cve-2026-91096-in-proxygen-from-v2024-10-28-00-until-v2026-09-28-00)
- [Meta proxygen use-after-free in WebTransport stream handling](https://junglewise.ai/threats/cve-2026-91095-in-proxygen-from-v2024-10-28-00-until-v2026-09-28-00-the)