# CVE-2026-119236: Meta mvfst QUIC server memory exhaustion in CRYPTO frame handling

Source: https://junglewise.ai/threats/cve-2026-119236-an-mvfst-quic-server-retained-crypto-frame-data-received-at-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-119236 · Severity: info · Published 2026-11-11

mvfst is Meta's QUIC implementation used in network communication. An unauthenticated attacker can exploit unbounded memory growth on QUIC servers by sending specially crafted encryption frames, causing the server to consume excessive memory and become unavailable. This denial-of-service attack requires no authentication and can impact any mvfst-based QUIC server.

Vendors: [Meta](https://junglewise.ai/threats/vendors/meta).

## Quick answers

**Is CVE-2026-119236 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119236 being exploited in the wild.

**How severe is CVE-2026-119236?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Meta Mvfst prior to v2026.11.09.00.

**Is there a fix for CVE-2026-119236?** Yes: fixed in v2026.11.09.00. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119236 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119236?** Check whether you run Meta Mvfst at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v2026.11.09.00

## Technical details

A QUIC server retains CRYPTO frame data from Initial or Handshake encryption levels even after the TLS handshake has advanced past them, allowing data to accumulate without triggering stream buffer limits. A remote attacker can exploit this by completing a handshake, withholding acknowledgment of HANDSHAKE_DONE to maintain Handshake keys, then sending Handshake-level CRYPTO frames at increasing offsets to trigger unbounded memory allocation and denial of service. This affects all mvfst versions prior to v2026.11.09.00.

## Affected products

- Meta mvfst prior to v2026.11.09.00

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44](https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44)
- [https://www.facebook.com/security/advisories/cve-2026-119236](https://www.facebook.com/security/advisories/cve-2026-119236)

## Related threats

- [mvfst QUIC stream reassembly denial of service](https://junglewise.ai/threats/cve-2026-119234-mvfst-did-not-adequately-merge-or-compact-out-of-order-stream)