{"id":"CVE-2026-119236","details":"An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could complete a handshake, withhold its acknowledgment of the server's HANDSHAKE_DONE frame so that Handshake keys stay in use, and keep sending Handshake-level CRYPTO data at increasing offsets, causing unbounded memory growth on the server and leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.00.","modified":"2026-11-13T07:01:52.954180700Z","published":"2026-11-11T17:17:16.800Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"DESCRIPTION","range":[{"fixed":"2026.11.09.00"}]}]}]},"references":[{"type":"ADVISORY","url":"https://www.facebook.com/security/advisories/cve-2026-119236"},{"type":"FIX","url":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/meta/mvfst","events":[{"introduced":"0"},{"fixed":"7e5cff58e8cbed87793141ceeca0a8a343c67c44"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"7e5cff58e8cbed87793141ceeca0a8a343c67c44"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v2026.10.26.00","v2026.10.19.00","v2026.10.12.00","v2026.10.05.00","v2026.09.28.00","v2026.09.21.00","v2026.09.14.00","v2026.09.07.00","v2026.08.31.00","v2026.08.24.00","v2026.08.17.00","v2026.08.10.00","v2026.08.03.00","v2026.07.27.00","v2026.07.20.00","v2026.07.13.00","v2026.07.06.00","v2026.06.29.00","v2026.06.22.00","v2026.06.15.00","v2026.06.08.00","v2026.06.01.00","v2026.05.25.00","v2026.05.18.00","v2026.05.11.00","v2026.05.04.00","v2026.04.27.00","v2026.04.20.00","v2026.04.13.00","v2026.04.06.00","v2026.03.30.00","v2026.03.23.00","v2026.03.16.00","v2026.03.09.00","v2026.03.02.00","v2026.02.23.00","v2026.02.16.00","v2026.02.09.00","v2026.02.02.00","v2026.01.26.00","v2026.01.19.00","v2026.01.12.00","v2026.01.05.00","v2025.12.29.00","v2025.12.22.00","v2025.12.15.00","v2025.12.01.00","v2025.11.24.00","v2025.11.17.00","v2025.11.10.00","v2025.11.03.00","v2025.10.27.00","v2025.10.20.00","v2025.10.13.00","v2025.10.06.00","v2025.09.29.00","v2025.09.22.00","v2025.09.15.00","v2025.09.08.00","v2025.09.01.00","v2025.08.25.00","v2025.08.18.00","v2025.08.11.00","v2025.08.04.00","v2025.07.28.00","v2025.07.21.00","v2025.07.14.00","v2025.07.07.00","v2025.06.30.00","v2025.06.23.00","v2025.06.16.00","v2025.06.09.00","v2025.06.02.00","v2025.05.26.00","v2025.05.19.00","v2025.05.12.00","v2025.05.05.00","v2025.04.28.00","v2025.04.21.00","v2025.04.14.00","v2025.04.07.00","v2025.03.31.00","v2025.03.24.00","v2025.03.17.00","v2025.03.10.00","v2025.03.03.00","v2025.02.24.00","v2025.02.17.00","v2025.02.10.00","v2025.02.03.00","v2025.01.27.00","v2025.01.20.00","v2025.01.13.00","v2025.01.06.00","v2024.12.30.00","v2024.12.23.00","v2024.12.16.00","v2024.12.09.00","v2024.12.02.00","v2024.11.25.00","v2024.11.18.00","v2024.11.11.00","v2024.11.04.00","v2024.10.28.00","v2024.10.21.00","v2024.10.14.00","v2024.10.07.00","v2024.09.30.00","v2024.09.23.00","v2024.09.16.00","v2024.09.09.00","v2024.09.02.00","v2024.08.26.00","v2024.08.19.00","v2024.08.12.00","v2024.08.05.00","v2024.07.29.00","v2024.07.22.00","v2024.07.15.00","v2024.07.08.00","v2024.07.01.00","v2024.06.24.00","v2024.06.17.00","v2024.06.10.00","v2024.06.03.00","v2024.05.27.00","v2024.05.20.00","v2024.05.13.00","v2024.05.06.00","v2024.05.02.00","v2024.04.29.00","v2024.04.22.00","v2024.04.15.00","v2024.04.08.00","v2024.04.01.00","v2024.03.25.00","v2024.03.18.00","v2024.03.11.00","v2024.03.04.00","v2024.02.26.00","v2024.02.19.00","v2024.02.12.00","v2024.02.05.00","v2024.01.29.00","v2024.01.22.00","v2024.01.15.00","v2024.01.08.00","v2024.01.01.00","v2023.12.25.00","v2023.12.18.00","v2023.12.11.00","v2023.12.04.00","v2023.11.27.00","v2023.11.20.00","v2023.11.13.00","v2023.11.06.00","v2023.10.30.00","v2023.10.23.00","v2023.10.16.00","v2023.10.09.00","v2023.10.02.00","v2023.09.25.00","v2023.09.18.00","v2023.09.11.00","v2023.09.04.00","v2023.08.28.00","v2023.08.14.00","v2023.08.07.00","v2023.07.24.00"],"database_specific":{"vanir_signatures_modified":"2026-11-13T07:01:52Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119236.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamManager.cpp","function":"QuicStreamManager::clearOpenStreams"},"deprecated":false,"digest":{"function_hash":"52999020636310987241096893444091115988","length":366},"id":"CVE-2026-119236-061236ff"},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"function":"appendDataToReadBuffer","file":"quic/state/QuicStreamFunctions.cpp"},"deprecated":false,"digest":{"length":284,"function_hash":"20992700338558858527676888628399953800"},"id":"CVE-2026-119236-08c222b2","signature_type":"Function"},{"id":"CVE-2026-119236-1c55b81f","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"readDataFromQuicStream"},"deprecated":false,"digest":{"length":1009,"function_hash":"117160165359804115562710716474173559840"}},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/api/QuicTransportBaseLite.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["190907153878062741029053406123710616608","207391061791620231187364137347435941704","81790574777895057719648658577597735506","244047087470572626937269635679326740230","252187565370676203217543740462309766021","251242758619375125364909569230476216594","329912927360665792850865535596013345921","152231444783283483859139005467633600663","134174626914964868702849693668118941764"]},"id":"CVE-2026-119236-20202284","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"consumeDataFromQuicStream"},"deprecated":false,"digest":{"function_hash":"240688870411873807980269580792624924961","length":906},"id":"CVE-2026-119236-213a1378","signature_type":"Function"},{"digest":{"function_hash":"206326542533718516512250830283197578528","length":3110},"id":"CVE-2026-119236-3613241c","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"function":"QuicStreamManager::removeClosedStream","file":"quic/state/QuicStreamManager.cpp"},"deprecated":false},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp"},"deprecated":false,"digest":{"line_hashes":["172933406495097381301247852137125673199","93263765849229485197508213512578436609","149927866449672659567985471594484780863","133073042797734606632430077549061314109","260241034750878034170520069554886203882","213106691768080592275780234762635104754","60508541644474044130995212717045313588","3155903335335332888265911714346797397","106446475866392097211965087437196876727","223117992349712410599942216007731500578","190380360411864515659065456790486174290","292791029161717257679892251263665519956","32551475189669653869641480142437822132","190192832189787277142831043660748238343","96908095064963469945128250708264369278","150773622809018122399486160754840758093","192709161131969813590274427915196747335","282819735292409566612641150541063999557","57931410775902619637601870290419709008","248178816924680551759296835103052119443","263055047005836967385434963935485127985","321134419058086729343000153625571034613","53023400051919763417739479692652587663","137293556450403648052220896039586194081","293443358623596320692910875016162186160","21497429062229852429153302348998769166","111736786313136755676907272509900369589","248901130094671406404260425550621207470","85230730578467097194973420895136569996","81250033974957209283979388091183616155","13114518927545096829485598610372242750","273980314797654851681674002268624685590","92347618516775411051314007845601584074","88052854537792835042396040920569413961","133392494280874035650174975792640088125","287124101854647475842426880166754905792","188518487702007312616162304532289342763","307574231139314398467449811702385563927","12847159617142049210844493588782174792","212099104116782054971581964358336049405","336492008065982985048766049386100533582","191939685333072302296178688440469548155","330417533061679252790992700112595590573","57846625080667235870332853022904793647","198058179854119663559325954400628419498","170514921101908499432838413615217009103","192783381306543021856439074550118141480","291142965426471439030892442399215440079","63798859445393944587981685549415810637","84208163321926531212794819658329974235","152980541757531767881535066752371958393","64845784493513996521362386481615987847","189614336477138032509692791966211120413","264213045113754134991840534378447346738","292692842608788337789821484019061505753","97939142382044880073624068379766086489","208704428340460855996635160923908380151","228469785589860637782223004722487249338","41035503051683687272139774093296614297","69052668898500961973602709949010635561","100918700088306849269870596619736496157","27054755676374394069199711239577019332","158592780656963327265807833706850681082","188048159692944135321155822466383518813","183601523565557021494387782296223306652","246895445983223103553372279174506120206","168925601655666741467613186726577150070","126317871649652390698727667841572017061","310831581832565483553297791644518688982","300227488306954389795005666746903127257","266289564303676263936601836723059048117","128617917835707781311418929222851562532","260071700992553457056255028041069805342","337689135473945075770988223838412030247","113560140403428559204779370970324661540","279480763140229773430435579102834739419","87720114506446220307343541714248942612","59821366985637439649480634800270194442","116227016467288375826156061382987008880","39232440061799637305904250512097171106","260071700992553457056255028041069805342","251910443136377292985814058442059709248","330701182532069289297519444968719098037","27943770420124131459941947055302865860","208349371230863088102516993223006545067","34013764633926567765940121591139522987","205458958021568015827895469800436370426","254744154696527416520820160201981439753","221330674084280351496219524765436979963","210760430653364983927671232184448395678","138804345171706363814250650671970589695","6288240912548341047240246043452902382","136271905785010097445242362573447386120","247573291868633480241691565520823071285","8369271529053547230182444811638253433","87316013584723104113595102758520982835","339566832804867730989615487593011612946"],"threshold":0.9},"id":"CVE-2026-119236-424ab081","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/QuicConstants.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["304220326986794039009960645421555271206","38730040725595358974204536378838991664","324229367666042595913090276776291308097","103666808951377972849057855147724467329"]},"id":"CVE-2026-119236-43847715","signature_type":"Line"},{"digest":{"line_hashes":["244300536953939214888356072019597927577","255489283181928711267647075719148556679","234747011678263751969763264041333887076","99860733498663438615040157774338891811","67635078041143233424321674495131077485","229071478357235822522021906937966885217","239702381846835329333633882465320024379","183479470189533361308541213421853638873","10324545446734500362246721410469774051","251248505296934618809775328361164914381"],"threshold":0.9},"id":"CVE-2026-119236-43dc3ba8","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/test/QuicServerTransportTest.cpp"},"deprecated":false},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"pushToTail"},"deprecated":false,"digest":{"function_hash":"230916243290409270653305747065532515856","length":698},"id":"CVE-2026-119236-46bf1c2b","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"function":"readBufferShape","file":"quic/state/test/QuicStreamFunctionsTest.cpp"},"deprecated":false,"digest":{"length":460,"function_hash":"41190058304417712333350467727019324960"},"id":"CVE-2026-119236-48dcdcda","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/ServerHandshake.cpp","function":"ServerHandshake::doHandshake"},"deprecated":false,"digest":{"function_hash":"39254118600132264015079997627126479482","length":679},"id":"CVE-2026-119236-4a2ff4a0"},{"target":{"file":"quic/api/test/QuicTransportBaseTest.cpp"},"deprecated":false,"digest":{"line_hashes":["179900156451657859057425080067264846293","79659078777170404222982082139536161125","36089561068559523439017743201087929895","22719985037160143916630529046284703791","100533613779895953905426414367020447765","270128164579061355938376126561929877806"],"threshold":0.9},"id":"CVE-2026-119236-5cfee485","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"id":"CVE-2026-119236-61ce8076","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"length":550,"function_hash":"188749163778230518063558452317117864915"}},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamManager.h"},"deprecated":false,"digest":{"line_hashes":["241287892842306386813156125904655261680","55338332683482168222234298724506922004","23653495792688331861039402157371391783","193686206377436575990544572143145555872","160598127751510657336779983640342566301","231896613607450665334227576178897626640","320419027217989401291951015199379881296"],"threshold":0.9},"id":"CVE-2026-119236-659b7dc1","signature_type":"Line"},{"target":{"file":"quic/server/handshake/test/ServerHandshakeTest.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["100021763284365514021931124847948596720","68750156886151483930534861942417401983","91869410714309949770868308094984146687","276453375393535318745178025251109565687","76614359540978121317388947712719803322","169198508010157687298561755800160378838","283347515554558080039361727033399713296","191670434421275739039727482363080706099","266170808162527027682061003704482786844","951063929099532741099674035801262209","324088041561811996410903087636323387742"]},"id":"CVE-2026-119236-6a5db9a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.h"},"deprecated":false,"digest":{"line_hashes":["307138389604428102488386460986269523985","248901130094671406404260425550621207470","181404577676393374725446180023158899038","206056034169063075653418572338974291519"],"threshold":0.9},"id":"CVE-2026-119236-6c138966","signature_type":"Line","signature_version":"v1"},{"digest":{"length":1555,"function_hash":"209687624047274607944913132254116417290"},"id":"CVE-2026-119236-76dd71fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/ServerHandshake.cpp","function":"ServerHandshake::processActions"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"321913470054212348001282907727260079761","length":716},"id":"CVE-2026-119236-7cdd2a85"},{"target":{"file":"quic/state/stream/test/StreamStateFunctionsTest.cpp"},"deprecated":false,"digest":{"line_hashes":["325743950747894668380737354713905370734","55487384951278491472734499977697200727"],"threshold":0.9},"id":"CVE-2026-119236-82925a88","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"id":"CVE-2026-119236-87bfd69c","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/ServerHandshake.h"},"deprecated":false,"digest":{"line_hashes":["172251140016189201501132208931765325427","183410790617600243551408867994121022144","59375339079710792075643703060035991285","168599969613236577361491224498357411303"],"threshold":0.9}},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"processTxStopSending"},"deprecated":false,"digest":{"function_hash":"287307784132836496116716998474179415307","length":310},"id":"CVE-2026-119236-8a59bd25","signature_type":"Function","signature_version":"v1"},{"target":{"file":"quic/state/stream/StreamStateFunctions.cpp"},"deprecated":false,"digest":{"line_hashes":["73389532865519299107669248126039434442","131731126451818170239241164390881634573","330299094778884738581711962932313516305","230257779459573430949362446128350074472","238529390871831055403985017878506163683","130025187850493146395499557371544254189","281022793939499165120147927611186159077","267547598218360825195949920011645237500"],"threshold":0.9},"id":"CVE-2026-119236-8b8653b8","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/api/QuicTransportBaseLite.cpp","function":"QuicTransportBaseLite::updateReadLooper"},"deprecated":false,"digest":{"length":880,"function_hash":"303839707602496343534065687956381963857"},"id":"CVE-2026-119236-93e40011"},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"function":"QuicStreamManager::QuicStreamManager","file":"quic/state/QuicStreamManager.cpp"},"deprecated":false,"digest":{"function_hash":"181130630721111142196337605612435582292","length":3454},"id":"CVE-2026-119236-9ad5ded6","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["155657546435448143352655733709081665541","210516037047118523111787213116984638840","66688167367010994449118698319267184677","46965370143667768294566755019007755512","327268446016237929103952785242069983704","109604580269345132188544908332425739235","54170786026274001470731330785970258749","19629162492494877044568492802630067398","141372878231316105420428761906589836062","211766279514593320745745855669964197740","257421956244549374540636162819060506404","137196060203543060023148552283242813095","225192407020672659157032450085989214657","274348219927748117158876313972985551539","196382310496348643407808201655732220827","65251699844514124450204002213209431548","15174619644335565817069038840908275344","169092724925044606138582053071186838466","240342642176554263401986056532333465359","40031170346202434199197123640630041562","133439769483651506398600925842406917172","41034461842301765436690129040447589527","129250793444412409654865453148772141552","190979650980044665950327196448277886052","37789075087333407653904131723437814571","123790881286899490428060884244773360409","322096002111014698052363667182670107127","20254950814494506742819070645437012458","63532062404343389952402549082508872930","309146880023459534720515121977325318986","266341634764120794767634341923648102840","7538020603723955509839812457626966267","278218811025783341969050244593955459161","149250710168733798331268316343175956706","172281953363075486695964278823870993773","231022149012326364970856935638187836239","190979650980044665950327196448277886052","37789075087333407653904131723437814571","27010381555377609473267158239010742298","224625259351097466238585248958850863606","278409125272048890874323934767124218022","253877949137870869907550003588226677923","309146880023459534720515121977325318986","266341634764120794767634341923648102840","201563585937675001913709327288988092896","247902523012979070807073234076171209873","278646339356152189770650596488420098588","93163207333470882191207452487561995054","190979650980044665950327196448277886052","136363868802517016303607115996479141548","334549635911117554597652087569879536243","184932388600891514134046892314622787052","99945604085083192863739557434804309918","119419716094053136747916000431955715893","9754996882787524293979116361323464743","258784903152404367341963953006067449462","278849830631775459938262526740818462904","307290501762426236975230285142660006194","296801341988621241521907430825324551511","333771009152019467822483971548487312759","105041690266514391735211556729816616772","139326051416861616351146978370198784157","52749482641868103504016723654083429553","84464346176075251458577212348034412555","85676901952370636548143597291351660083","160284583549360403711462530714359844876","273550412194007467684024000402119643503","6560888468316213099845912951730298747","302498319736879013309525852358216530835","193066044730471703199155665254930596157","131097722829410650708724055452867255262","309967723660835536651540459239225356644","131286905487930808589326120292239501883","290694762578211169324212419195405712996","265758810945775848125618417065913317491","72479534788071523563017045710570755298"]},"id":"CVE-2026-119236-a109c1bb"},{"target":{"file":"quic/server/test/QuicServerTransportTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"244218159119026207204306409849862523032","length":2183},"id":"CVE-2026-119236-b2005076","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"id":"CVE-2026-119236-b3c9c88e","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/test/ServerHandshakeTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"317755108304475897737801883224112207108","length":819}},{"source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamManager.cpp"},"deprecated":false,"digest":{"line_hashes":["227628619414859261847411332849827857876","183722561726432675653265082312820090139","50539320132016689740183000846677860921","106047690898790660410340177161769218538","72428962098989751507134439725674616498","327633989180691222565918689954440179453","315119325949719286165647425778149352396","185308740905125311094716054692223020453","299376931264038512501003459580934065747","222591327722043190718490869880389988001","75357005113548408821109689476372665677","78934788376575869143990339726855182400","173076099688884903710473027858054556733"],"threshold":0.9},"id":"CVE-2026-119236-bf9a604f","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-119236-c3ba5953","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"length":856,"function_hash":"20038100394372529568172437216376943162"}},{"deprecated":false,"digest":{"length":334,"function_hash":"145959750714456074150514548556218019735"},"id":"CVE-2026-119236-c960ada5","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/stream/StreamStateFunctions.cpp","function":"retireIngress"}},{"target":{"file":"quic/state/test/QuicStreamManagerTest.cpp"},"deprecated":false,"digest":{"line_hashes":["76310356253565037297725838670414325537","269397026268917270295924167202330838838","213992801032697634595782362348416185836"],"threshold":0.9},"id":"CVE-2026-119236-cfe3ecd2","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/stream/StreamStateFunctions.cpp","function":"onResetQuicStream"},"deprecated":false,"digest":{"function_hash":"243820828900165661007538303206174466512","length":2116},"id":"CVE-2026-119236-d1ff65e2","signature_type":"Function"},{"id":"CVE-2026-119236-d5e02fbe","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/server/handshake/ServerHandshake.cpp"},"deprecated":false,"digest":{"line_hashes":["148154987050969472072597491668197745520","296930668730259876157187760409140810935","216953224538081850830288845373607075843","285417876488192957803813115510586544165","304881428560849928274268340165951289375","75216220815472612407772874696301046598","48077542505172849350998795846944035551","337769105800032590165085033196235683045","71747410606964794934108167622576630314","327704143034122326750391950032038807640","193821799076480932685583667521133451700","308546011397481261049503071409297425373","323273070497558150204912377106070674485","213271752600440301735072314371923296547"],"threshold":0.9}},{"digest":{"length":491,"function_hash":"50470122300256524783471803395634471360"},"id":"CVE-2026-119236-d850cbf2","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/QuicStreamFunctions.cpp","function":"appendDataToReadBuffer"},"deprecated":false},{"digest":{"function_hash":"288856332048961195481042126578227762191","length":581},"id":"CVE-2026-119236-e46273b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44","target":{"file":"quic/state/test/QuicStreamFunctionsTest.cpp","function":"TEST_F"},"deprecated":false},{"target":{"file":"quic/common/BufUtil.h"},"deprecated":false,"digest":{"line_hashes":["256183629578542931176892905665335827097","126305054921605979874562401678396019318","18252638165613331032599620344642689685"],"threshold":0.9},"id":"CVE-2026-119236-f7771504","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"}]}}],"schema_version":"1.9.2"}