Executive brief
Proxygen, a high-performance HTTP framework, is vulnerable to a resource exhaustion attack. A remote attacker can exploit how the server handles data flow to force it to store large amounts of information in memory indefinitely. This can lead to the server running out of memory, causing service slowdowns or a complete crash, effectively taking the application offline.
Technical details
A vulnerability in Proxygen's core HTTP session layer stems from the lack of a generalized slow-consumer detection mechanism. A remote, unauthenticated attacker can exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames. This forces the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening numerous simultaneous streams for large resources while preventing transmission, an attacker can cause unbounded memory growth, leading to resource exhaustion and denial of service (DoS). The fix introduces an edge-triggered slow-consumer detector in HTTPSessionBase that drops connections if pending writes exceed a defined threshold without sufficient forward progress.
Affected products
- Facebook Proxygen v2017.01.16.00 through v2026.07.20.00
Timeline
- 2026-07-16: patched: Fix committed to GitHub repository
- 2026-07-23: advisory: NVD advisory published