{"id":"CVE-2026-119234","details":"mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC peer could send many small, non-contiguous stream fragments to make an endpoint consume memory far in excess of its advertised receive window and spend increasing CPU time reassembling stream data, leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.0.","modified":"2026-11-14T13:28:01.784900110Z","published":"2026-11-11T17:17:16.543Z","database_specific":{},"references":[{"type":"ADVISORY","url":"https://www.facebook.com/security/advisories/cve-2026-119234"},{"type":"FIX","url":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/meta/mvfst","events":[{"introduced":"0"},{"fixed":"0a1c344990b4cc427591c45b943921a0bf28911d"},{"fixed":"7e5cff58e8cbed87793141ceeca0a8a343c67c44"}],"database_specific":{"extracted_events":[{"source":"DESCRIPTION","range":[{"introduced":"0"},{"fixed":"2026.11.09.0"}]},{"range":[{"fixed":"7e5cff58e8cbed87793141ceeca0a8a343c67c44"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v2026.10.26.00","v2026.10.19.00","v2026.10.12.00","v2026.10.05.00","v2026.09.28.00","v2026.09.21.00","v2026.09.14.00","v2026.09.07.00","v2026.08.31.00","v2026.08.24.00","v2026.08.17.00","v2026.08.10.00","v2026.08.03.00","v2026.07.27.00","v2026.07.20.00","v2026.07.13.00","v2026.07.06.00","v2026.06.29.00","v2026.06.22.00","v2026.06.15.00","v2026.06.08.00","v2026.06.01.00","v2026.05.25.00","v2026.05.18.00","v2026.05.11.00","v2026.05.04.00","v2026.04.27.00","v2026.04.20.00","v2026.04.13.00","v2026.04.06.00","v2026.03.30.00","v2026.03.23.00","v2026.03.16.00","v2026.03.09.00","v2026.03.02.00","v2026.02.23.00","v2026.02.16.00","v2026.02.09.00","v2026.02.02.00","v2026.01.26.00","v2026.01.19.00","v2026.01.12.00","v2026.01.05.00","v2025.12.29.00","v2025.12.22.00","v2025.12.15.00","v2025.12.01.00","v2025.11.24.00","v2025.11.17.00","v2025.11.10.00","v2025.11.03.00","v2025.10.27.00","v2025.10.20.00","v2025.10.13.00","v2025.10.06.00","v2025.09.29.00","v2025.09.22.00","v2025.09.15.00","v2025.09.08.00","v2025.09.01.00","v2025.08.25.00","v2025.08.18.00","v2025.08.11.00","v2025.08.04.00","v2025.07.28.00","v2025.07.21.00","v2025.07.14.00","v2025.07.07.00","v2025.06.30.00","v2025.06.23.00","v2025.06.16.00","v2025.06.09.00","v2025.06.02.00","v2025.05.26.00","v2025.05.19.00","v2025.05.12.00","v2025.05.05.00","v2025.04.28.00","v2025.04.21.00","v2025.04.14.00","v2025.04.07.00","v2025.03.31.00","v2025.03.24.00","v2025.03.17.00","v2025.03.10.00","v2025.03.03.00","v2025.02.24.00","v2025.02.17.00","v2025.02.10.00","v2025.02.03.00","v2025.01.27.00","v2025.01.20.00","v2025.01.13.00","v2025.01.06.00","v2024.12.30.00","v2024.12.23.00","v2024.12.16.00","v2024.12.09.00","v2024.12.02.00","v2024.11.25.00","v2024.11.18.00","v2024.11.11.00","v2024.11.04.00","v2024.10.28.00","v2024.10.21.00","v2024.10.14.00","v2024.10.07.00","v2024.09.30.00","v2024.09.23.00","v2024.09.16.00","v2024.09.09.00","v2024.09.02.00","v2024.08.26.00","v2024.08.19.00","v2024.08.12.00","v2024.08.05.00","v2024.07.29.00","v2024.07.22.00","v2024.07.15.00","v2024.07.08.00","v2024.07.01.00","v2024.06.24.00","v2024.06.17.00","v2024.06.10.00","v2024.06.03.00","v2024.05.27.00","v2024.05.20.00","v2024.05.13.00","v2024.05.06.00","v2024.05.02.00","v2024.04.29.00","v2024.04.22.00","v2024.04.15.00","v2024.04.08.00","v2024.04.01.00","v2024.03.25.00","v2024.03.18.00","v2024.03.11.00","v2024.03.04.00","v2024.02.26.00","v2024.02.19.00","v2024.02.12.00","v2024.02.05.00","v2024.01.29.00","v2024.01.22.00","v2024.01.15.00","v2024.01.08.00","v2024.01.01.00","v2023.12.25.00","v2023.12.18.00","v2023.12.11.00","v2023.12.04.00","v2023.11.27.00","v2023.11.20.00","v2023.11.13.00","v2023.11.06.00","v2023.10.30.00","v2023.10.23.00","v2023.10.16.00","v2023.10.09.00","v2023.10.02.00","v2023.09.25.00","v2023.09.18.00","v2023.09.11.00","v2023.09.04.00","v2023.08.28.00","v2023.08.14.00","v2023.08.07.00","v2023.07.24.00"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119234.json","vanir_signatures":[{"target":{"file":"quic/common/ContiguousCursor.cpp"},"deprecated":false,"digest":{"line_hashes":["76727250114250757125910198345051611799","109355734001361688163948626083408924134","166228991637490959188414345110282105886","202629258858385320321541160966072317320","59979440951488266505799065297413318497","261340746860166116874154551406233419649","266689551779680906228555189978183705231","157817276986241489210063066158886299863","22142176435242819574679220589463163615","313476897367261105278353943429063159883","191735217072808576489950461579454240897","10294001794970172267228707607301705236","84049974536274073260601672085153375590","166121122795391765828165251371412126013","280019240872068096836478801534800109677","144161861878417217222375861537667633891"],"threshold":0.9},"id":"CVE-2026-119234-02005fda","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d"},{"target":{"function":"QuicStreamManager::clearOpenStreams","file":"quic/state/QuicStreamManager.cpp"},"deprecated":false,"digest":{"function_hash":"52999020636310987241096893444091115988","length":366},"id":"CVE-2026-119234-061236ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"target":{"function":"appendDataToReadBuffer","file":"quic/state/QuicStreamFunctions.cpp"},"deprecated":false,"digest":{"length":284,"function_hash":"20992700338558858527676888628399953800"},"id":"CVE-2026-119234-08c222b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"target":{"file":"quic/common/BufUtil.cpp","function":"fillIovec"},"deprecated":false,"digest":{"length":358,"function_hash":"285650976204211221812773472439870328394"},"id":"CVE-2026-119234-152be424","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d"},{"deprecated":false,"digest":{"line_hashes":["83326038603688868828785134851563782176","256816563015245025029241610270733619027","204169165240516646712648290209667644221","72443399672281481985108018997771905005","261734619491249298942292281576428672451","108045249587896933637495020670185407421","62063146427456024073321403822500914255","334977800159687243962685682804581266123","312184611052355197156724847931033604373","220034328397778536268834671805219075559","242820019319747632467903295573777929021","154768790483385124576313241294285556645","319223573938573801493019577494715598141","335606088737682545383809584729041357246","197489828553870088368031822331967247310","229826400466925194122000687015750609705","276820499424868182312691907720651878684","109029592124602955457252458248466881324","9425612526940913183007371376667334283","148349563911401873262604417856870073509"],"threshold":0.9},"id":"CVE-2026-119234-190272ee","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/common/udpsocket/QuicAsyncUDPSocketImpl.cpp"}},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"readDataFromQuicStream"},"deprecated":false,"digest":{"length":1009,"function_hash":"117160165359804115562710716474173559840"},"id":"CVE-2026-119234-1c55b81f","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-119234-20202284","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/api/QuicTransportBaseLite.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["190907153878062741029053406123710616608","207391061791620231187364137347435941704","81790574777895057719648658577597735506","244047087470572626937269635679326740230","252187565370676203217543740462309766021","251242758619375125364909569230476216594","329912927360665792850865535596013345921","152231444783283483859139005467633600663","134174626914964868702849693668118941764"]}},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"consumeDataFromQuicStream"},"deprecated":false,"digest":{"function_hash":"240688870411873807980269580792624924961","length":906},"id":"CVE-2026-119234-213a1378","signature_type":"Function"},{"digest":{"function_hash":"206326542533718516512250830283197578528","length":3110},"id":"CVE-2026-119234-3613241c","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamManager.cpp","function":"QuicStreamManager::removeClosedStream"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/common/ContiguousCursor.h"},"deprecated":false,"digest":{"line_hashes":["166043063087339323482509734807307574707","100115309024530175783034013667954813142","90989211952165404992579450972793447481","218842867255346669496485488778586086840","40989405804651720223445611528495250403","30902321820957996970169773314930176709","296206630711684426620988196488029623750","5594161084209212503840895928694685134"],"threshold":0.9},"id":"CVE-2026-119234-3833e952"},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"function":"QuicAsyncUDPSocketImpl::recvmmsgNetworkData","file":"quic/common/udpsocket/QuicAsyncUDPSocketImpl.cpp"},"deprecated":false,"digest":{"function_hash":"165622074001850534568531364138824716426","length":4246},"id":"CVE-2026-119234-3d971ea3","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp"},"deprecated":false,"digest":{"line_hashes":["172933406495097381301247852137125673199","93263765849229485197508213512578436609","149927866449672659567985471594484780863","133073042797734606632430077549061314109","260241034750878034170520069554886203882","213106691768080592275780234762635104754","60508541644474044130995212717045313588","3155903335335332888265911714346797397","106446475866392097211965087437196876727","223117992349712410599942216007731500578","190380360411864515659065456790486174290","292791029161717257679892251263665519956","32551475189669653869641480142437822132","190192832189787277142831043660748238343","96908095064963469945128250708264369278","150773622809018122399486160754840758093","192709161131969813590274427915196747335","282819735292409566612641150541063999557","57931410775902619637601870290419709008","248178816924680551759296835103052119443","263055047005836967385434963935485127985","321134419058086729343000153625571034613","53023400051919763417739479692652587663","137293556450403648052220896039586194081","293443358623596320692910875016162186160","21497429062229852429153302348998769166","111736786313136755676907272509900369589","248901130094671406404260425550621207470","85230730578467097194973420895136569996","81250033974957209283979388091183616155","13114518927545096829485598610372242750","273980314797654851681674002268624685590","92347618516775411051314007845601584074","88052854537792835042396040920569413961","133392494280874035650174975792640088125","287124101854647475842426880166754905792","188518487702007312616162304532289342763","307574231139314398467449811702385563927","12847159617142049210844493588782174792","212099104116782054971581964358336049405","336492008065982985048766049386100533582","191939685333072302296178688440469548155","330417533061679252790992700112595590573","57846625080667235870332853022904793647","198058179854119663559325954400628419498","170514921101908499432838413615217009103","192783381306543021856439074550118141480","291142965426471439030892442399215440079","63798859445393944587981685549415810637","84208163321926531212794819658329974235","152980541757531767881535066752371958393","64845784493513996521362386481615987847","189614336477138032509692791966211120413","264213045113754134991840534378447346738","292692842608788337789821484019061505753","97939142382044880073624068379766086489","208704428340460855996635160923908380151","228469785589860637782223004722487249338","41035503051683687272139774093296614297","69052668898500961973602709949010635561","100918700088306849269870596619736496157","27054755676374394069199711239577019332","158592780656963327265807833706850681082","188048159692944135321155822466383518813","183601523565557021494387782296223306652","246895445983223103553372279174506120206","168925601655666741467613186726577150070","126317871649652390698727667841572017061","310831581832565483553297791644518688982","300227488306954389795005666746903127257","266289564303676263936601836723059048117","128617917835707781311418929222851562532","260071700992553457056255028041069805342","337689135473945075770988223838412030247","113560140403428559204779370970324661540","279480763140229773430435579102834739419","87720114506446220307343541714248942612","59821366985637439649480634800270194442","116227016467288375826156061382987008880","39232440061799637305904250512097171106","260071700992553457056255028041069805342","251910443136377292985814058442059709248","330701182532069289297519444968719098037","27943770420124131459941947055302865860","208349371230863088102516993223006545067","34013764633926567765940121591139522987","205458958021568015827895469800436370426","254744154696527416520820160201981439753","221330674084280351496219524765436979963","210760430653364983927671232184448395678","138804345171706363814250650671970589695","6288240912548341047240246043452902382","136271905785010097445242362573447386120","247573291868633480241691565520823071285","8369271529053547230182444811638253433","87316013584723104113595102758520982835","339566832804867730989615487593011612946"],"threshold":0.9},"id":"CVE-2026-119234-424ab081"},{"target":{"file":"quic/QuicConstants.h"},"deprecated":false,"digest":{"line_hashes":["304220326986794039009960645421555271206","38730040725595358974204536378838991664","324229367666042595913090276776291308097","103666808951377972849057855147724467329"],"threshold":0.9},"id":"CVE-2026-119234-43847715","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/test/QuicServerTransportTest.cpp"},"deprecated":false,"digest":{"line_hashes":["244300536953939214888356072019597927577","255489283181928711267647075719148556679","234747011678263751969763264041333887076","99860733498663438615040157774338891811","67635078041143233424321674495131077485","229071478357235822522021906937966885217","239702381846835329333633882465320024379","183479470189533361308541213421853638873","10324545446734500362246721410469774051","251248505296934618809775328361164914381"],"threshold":0.9},"id":"CVE-2026-119234-43dc3ba8","signature_type":"Line","signature_version":"v1"},{"digest":{"length":698,"function_hash":"230916243290409270653305747065532515856"},"id":"CVE-2026-119234-46bf1c2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"pushToTail"},"deprecated":false},{"target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"readBufferShape"},"deprecated":false,"digest":{"length":460,"function_hash":"41190058304417712333350467727019324960"},"id":"CVE-2026-119234-48dcdcda","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/ServerHandshake.cpp","function":"ServerHandshake::doHandshake"},"deprecated":false,"digest":{"function_hash":"39254118600132264015079997627126479482","length":679},"id":"CVE-2026-119234-4a2ff4a0","signature_type":"Function","signature_version":"v1"},{"digest":{"length":484,"function_hash":"217586562070744752361670792124029548917"},"id":"CVE-2026-119234-594f9393","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"function":"QuicClientTransport::readWithRecvmmsg","file":"quic/client/QuicClientTransport.cpp"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"167935431613265112555482510388829988947","length":536},"id":"CVE-2026-119234-5a4c18dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/api/QuicBatchWriter.cpp","function":"SendmmsgInplacePacketBatchWriter::append"}},{"id":"CVE-2026-119234-5cfee485","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/api/test/QuicTransportBaseTest.cpp"},"deprecated":false,"digest":{"line_hashes":["179900156451657859057425080067264846293","79659078777170404222982082139536161125","36089561068559523439017743201087929895","22719985037160143916630529046284703791","100533613779895953905426414367020447765","270128164579061355938376126561929877806"],"threshold":0.9}},{"digest":{"line_hashes":["159304694581112312173507399698854646427","101830465785076309146629586082897804431","307491450173078117944175734168870767133","52332679135016515742447090426830770762","85362526700203533139798497017257478351","124203818406736986023463440763230470188","249241621800382994278080465846563014243","97388499469740764842280433246671234857"],"threshold":0.9},"id":"CVE-2026-119234-5d1e4205","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/api/QuicBatchWriter.cpp"},"deprecated":false},{"deprecated":false,"digest":{"length":550,"function_hash":"188749163778230518063558452317117864915"},"id":"CVE-2026-119234-61ce8076","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"TEST_F"}},{"target":{"file":"quic/state/QuicStreamManager.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["241287892842306386813156125904655261680","55338332683482168222234298724506922004","23653495792688331861039402157371391783","193686206377436575990544572143145555872","160598127751510657336779983640342566301","231896613607450665334227576178897626640","320419027217989401291951015199379881296"]},"id":"CVE-2026-119234-659b7dc1","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/test/ServerHandshakeTest.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["100021763284365514021931124847948596720","68750156886151483930534861942417401983","91869410714309949770868308094984146687","276453375393535318745178025251109565687","76614359540978121317388947712719803322","169198508010157687298561755800160378838","283347515554558080039361727033399713296","191670434421275739039727482363080706099","266170808162527027682061003704482786844","951063929099532741099674035801262209","324088041561811996410903087636323387742"]},"id":"CVE-2026-119234-6a5db9a2","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["307138389604428102488386460986269523985","248901130094671406404260425550621207470","181404577676393374725446180023158899038","206056034169063075653418572338974291519"],"threshold":0.9},"id":"CVE-2026-119234-6c138966","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.h"},"deprecated":false},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/ServerHandshake.cpp","function":"ServerHandshake::processActions"},"deprecated":false,"digest":{"length":1555,"function_hash":"209687624047274607944913132254116417290"},"id":"CVE-2026-119234-76dd71fe","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/client/QuicClientTransport.cpp","function":"QuicClientTransport::readWithRecvmsg"},"deprecated":false,"digest":{"function_hash":"206290773323508341398853862829664516541","length":445},"id":"CVE-2026-119234-7b8cd74a","signature_type":"Function","signature_version":"v1"},{"target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"length":716,"function_hash":"321913470054212348001282907727260079761"},"id":"CVE-2026-119234-7cdd2a85","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["325743950747894668380737354713905370734","55487384951278491472734499977697200727"]},"id":"CVE-2026-119234-82925a88","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/stream/test/StreamStateFunctionsTest.cpp"}},{"digest":{"line_hashes":["172251140016189201501132208931765325427","183410790617600243551408867994121022144","59375339079710792075643703060035991285","168599969613236577361491224498357411303"],"threshold":0.9},"id":"CVE-2026-119234-87bfd69c","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/ServerHandshake.h"},"deprecated":false},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"function":"processTxStopSending","file":"quic/state/QuicStreamFunctions.cpp"},"deprecated":false,"digest":{"function_hash":"287307784132836496116716998474179415307","length":310},"id":"CVE-2026-119234-8a59bd25","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/stream/StreamStateFunctions.cpp"},"deprecated":false,"digest":{"line_hashes":["73389532865519299107669248126039434442","131731126451818170239241164390881634573","330299094778884738581711962932313516305","230257779459573430949362446128350074472","238529390871831055403985017878506163683","130025187850493146395499557371544254189","281022793939499165120147927611186159077","267547598218360825195949920011645237500"],"threshold":0.9},"id":"CVE-2026-119234-8b8653b8"},{"target":{"file":"quic/api/QuicBatchWriter.cpp","function":"SendmmsgPacketBatchWriter::append"},"deprecated":false,"digest":{"function_hash":"83210215617367533927213281574024967569","length":301},"id":"CVE-2026-119234-8f46fbb6","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"function":"QuicTransportBaseLite::updateReadLooper","file":"quic/api/QuicTransportBaseLite.cpp"},"deprecated":false,"digest":{"function_hash":"303839707602496343534065687956381963857","length":880},"id":"CVE-2026-119234-93e40011"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["190515947370815280930421781510828776789","122123338344081974938086150355272117282","49770519263547865371325111306602890958","212109359505987258770023755268066592514"]},"id":"CVE-2026-119234-993cacba","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/common/BufUtil.cpp"}},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamManager.cpp","function":"QuicStreamManager::QuicStreamManager"},"deprecated":false,"digest":{"function_hash":"181130630721111142196337605612435582292","length":3454},"id":"CVE-2026-119234-9ad5ded6","signature_type":"Function","signature_version":"v1"},{"target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["155657546435448143352655733709081665541","210516037047118523111787213116984638840","66688167367010994449118698319267184677","46965370143667768294566755019007755512","327268446016237929103952785242069983704","109604580269345132188544908332425739235","54170786026274001470731330785970258749","19629162492494877044568492802630067398","141372878231316105420428761906589836062","211766279514593320745745855669964197740","257421956244549374540636162819060506404","137196060203543060023148552283242813095","225192407020672659157032450085989214657","274348219927748117158876313972985551539","196382310496348643407808201655732220827","65251699844514124450204002213209431548","15174619644335565817069038840908275344","169092724925044606138582053071186838466","240342642176554263401986056532333465359","40031170346202434199197123640630041562","133439769483651506398600925842406917172","41034461842301765436690129040447589527","129250793444412409654865453148772141552","190979650980044665950327196448277886052","37789075087333407653904131723437814571","123790881286899490428060884244773360409","322096002111014698052363667182670107127","20254950814494506742819070645437012458","63532062404343389952402549082508872930","309146880023459534720515121977325318986","266341634764120794767634341923648102840","7538020603723955509839812457626966267","278218811025783341969050244593955459161","149250710168733798331268316343175956706","172281953363075486695964278823870993773","231022149012326364970856935638187836239","190979650980044665950327196448277886052","37789075087333407653904131723437814571","27010381555377609473267158239010742298","224625259351097466238585248958850863606","278409125272048890874323934767124218022","253877949137870869907550003588226677923","309146880023459534720515121977325318986","266341634764120794767634341923648102840","201563585937675001913709327288988092896","247902523012979070807073234076171209873","278646339356152189770650596488420098588","93163207333470882191207452487561995054","190979650980044665950327196448277886052","136363868802517016303607115996479141548","334549635911117554597652087569879536243","184932388600891514134046892314622787052","99945604085083192863739557434804309918","119419716094053136747916000431955715893","9754996882787524293979116361323464743","258784903152404367341963953006067449462","278849830631775459938262526740818462904","307290501762426236975230285142660006194","296801341988621241521907430825324551511","333771009152019467822483971548487312759","105041690266514391735211556729816616772","139326051416861616351146978370198784157","52749482641868103504016723654083429553","84464346176075251458577212348034412555","85676901952370636548143597291351660083","160284583549360403711462530714359844876","273550412194007467684024000402119643503","6560888468316213099845912951730298747","302498319736879013309525852358216530835","193066044730471703199155665254930596157","131097722829410650708724055452867255262","309967723660835536651540459239225356644","131286905487930808589326120292239501883","290694762578211169324212419195405712996","265758810945775848125618417065913317491","72479534788071523563017045710570755298"]},"id":"CVE-2026-119234-a109c1bb","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"deprecated":false,"digest":{"function_hash":"244218159119026207204306409849862523032","length":2183},"id":"CVE-2026-119234-b2005076","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/test/QuicServerTransportTest.cpp","function":"TEST_F"}},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/test/ServerHandshakeTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"317755108304475897737801883224112207108","length":819},"id":"CVE-2026-119234-b3c9c88e","signature_type":"Function"},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamManager.cpp"},"deprecated":false,"digest":{"line_hashes":["227628619414859261847411332849827857876","183722561726432675653265082312820090139","50539320132016689740183000846677860921","106047690898790660410340177161769218538","72428962098989751507134439725674616498","327633989180691222565918689954440179453","315119325949719286165647425778149352396","185308740905125311094716054692223020453","299376931264038512501003459580934065747","222591327722043190718490869880389988001","75357005113548408821109689476372665677","78934788376575869143990339726855182400","173076099688884903710473027858054556733"],"threshold":0.9},"id":"CVE-2026-119234-bf9a604f","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/api/QuicGsoBatchWriters.cpp","function":"GSOPacketBatchWriter::append"},"deprecated":false,"digest":{"function_hash":"152857897494058210691349746313544917988","length":445},"id":"CVE-2026-119234-bfbeb1f2"},{"digest":{"function_hash":"20038100394372529568172437216376943162","length":856},"id":"CVE-2026-119234-c3ba5953","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"TEST_F"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"function":"retireIngress","file":"quic/state/stream/StreamStateFunctions.cpp"},"deprecated":false,"digest":{"function_hash":"145959750714456074150514548556218019735","length":334},"id":"CVE-2026-119234-c960ada5","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["15504696653242880006172886938190280215","167906377625753944361093848695931227585","222910678502692750807992696069409572144","104514360724910082558791056884835352645"],"threshold":0.9},"id":"CVE-2026-119234-cb78fd84","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/api/QuicGsoBatchWriters.cpp"}},{"digest":{"function_hash":"253099072282207845318372128566058483571","length":1436},"id":"CVE-2026-119234-cf6bed7d","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"function":"QuicClientTransport::readWithRecvmmsgWrapper","file":"quic/client/QuicClientTransport.cpp"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamManagerTest.cpp"},"deprecated":false,"digest":{"line_hashes":["76310356253565037297725838670414325537","269397026268917270295924167202330838838","213992801032697634595782362348416185836"],"threshold":0.9},"id":"CVE-2026-119234-cfe3ecd2"},{"digest":{"function_hash":"243820828900165661007538303206174466512","length":2116},"id":"CVE-2026-119234-d1ff65e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/stream/StreamStateFunctions.cpp","function":"onResetQuicStream"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/ServerHandshake.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148154987050969472072597491668197745520","296930668730259876157187760409140810935","216953224538081850830288845373607075843","285417876488192957803813115510586544165","304881428560849928274268340165951289375","75216220815472612407772874696301046598","48077542505172849350998795846944035551","337769105800032590165085033196235683045","71747410606964794934108167622576630314","327704143034122326750391950032038807640","193821799076480932685583667521133451700","308546011397481261049503071409297425373","323273070497558150204912377106070674485","213271752600440301735072314371923296547"]},"id":"CVE-2026-119234-d5e02fbe","signature_type":"Line"},{"target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"appendDataToReadBuffer"},"deprecated":false,"digest":{"function_hash":"50470122300256524783471803395634471360","length":491},"id":"CVE-2026-119234-d850cbf2","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"288856332048961195481042126578227762191","length":581},"id":"CVE-2026-119234-e46273b2","signature_type":"Function"},{"digest":{"line_hashes":["203460977570513806428024416022134704750","7489823220868263992829930314742290253","18402823475475695156114009722439343626","129772735668619129205394519234916468331","270452030192760134773305364901260258082","7489823220868263992829930314742290253","18402823475475695156114009722439343626","129772735668619129205394519234916468331","270452030192760134773305364901260258082","7489823220868263992829930314742290253","18402823475475695156114009722439343626","129772735668619129205394519234916468331"],"threshold":0.9},"id":"CVE-2026-119234-e91beca7","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/0a1c344990b4cc427591c45b943921a0bf28911d","target":{"file":"quic/client/QuicClientTransport.cpp"},"deprecated":false},{"id":"CVE-2026-119234-f7771504","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/common/BufUtil.h"},"deprecated":false,"digest":{"line_hashes":["256183629578542931176892905665335827097","126305054921605979874562401678396019318","18252638165613331032599620344642689685"],"threshold":0.9}}],"vanir_signatures_modified":"2026-11-14T13:28:01Z"}}],"schema_version":"1.9.2"}