{"id":"CVE-2026-121737","details":"When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based HTTP session could free that pipelined stream while resetting the connection's streams on the resulting write timeout, then go on to use it. This can crash the server, leading to denial of service, and may allow memory corruption with further impact. This issue affects proxygen versions prior to v2026.11.09.00.","modified":"2026-11-14T07:06:18.851175624Z","published":"2026-11-11T17:17:17.337Z","database_specific":{},"references":[{"type":"ADVISORY","url":"https://www.facebook.com/security/advisories/cve-2026-121737"},{"type":"FIX","url":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/meta/proxygen","events":[{"introduced":"0"},{"fixed":"0c2a067ec61de88f6199b93c867a358a2b2adc9f"},{"fixed":"daf245bba7fe1304b9491403fe56f91153299781"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"2026.11.09.00"}],"source":"DESCRIPTION"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"daf245bba7fe1304b9491403fe56f91153299781"}]}]}}],"versions":["v2026.10.26.00","v2026.10.19.00","v2026.10.12.00","v2026.10.05.00","v2026.09.28.00","v2026.09.21.00","v2026.09.14.00","v2026.09.07.00","v2026.08.31.00","v2026.08.24.00","v2026.08.17.00","v2026.08.10.00","v2026.08.03.00","v2026.07.27.00","v2026.07.20.00","v2026.07.13.00","v2026.07.06.00","v2026.06.29.00","v2026.06.22.00","v2026.06.15.00","v2026.06.08.00","v2026.06.01.00","v2026.05.25.00","v2026.05.18.00","v2026.05.11.00","v2026.05.04.00","v2026.04.27.00","v2026.04.20.00","v2026.04.13.00","v2026.04.06.00","v2026.03.30.00","v2026.03.23.00","v2026.03.16.00","v2026.03.09.00","v2026.03.02.00","v2026.02.23.00","v2026.02.16.00","v2026.02.09.00","v2026.02.02.00","v2026.01.26.00","v2026.01.19.00","v2026.01.12.00","v2026.01.05.00","v2025.12.29.00","v2025.12.22.00","v2025.12.15.00","v2025.12.02.00","v2025.12.01.00","v2025.11.24.00","v2025.11.17.00","v2025.11.10.00","v2025.11.03.00","v2025.10.27.00","v2025.10.20.00","v2025.10.13.00","v2025.10.06.00","v2025.09.29.00","v2025.09.22.00","v2025.09.15.00","v2025.09.08.00","v2025.09.01.00","v2025.08.25.00","v2025.08.18.00","v2025.08.11.00","v2025.08.04.00","v2025.07.28.00","v2025.07.21.00","v2025.07.14.00","v2025.07.07.00","v2025.06.30.00","v2025.06.23.00","v2025.06.16.00","v2025.06.09.00","v2025.06.02.00","v2025.05.26.00","v2025.05.19.00","v2025.05.12.00","v2025.05.05.00","v2025.04.28.00","v2025.04.21.00","v2025.04.14.00","v2025.04.07.00","v2025.03.31.00","v2025.03.24.00","v2025.03.17.00","v2025.03.10.00","v2025.03.03.00","v2025.02.24.00","v2025.02.17.00","v2025.02.10.00","v2025.02.03.00","v2025.01.27.00","v2025.01.20.00","v2025.01.13.00","v2025.01.06.00","v2024.12.30.00","v2024.12.23.00","v2024.12.16.00","v2024.12.09.00","v2024.12.02.00","v2024.11.25.00","v2024.11.18.00","v2024.11.11.00","v2024.11.04.00","v2024.10.28.00","v2024.10.21.00","v2024.10.14.00","v2024.10.07.00","v2024.09.30.00","v2024.09.23.00","v2024.09.16.00","v2024.09.09.00","v2024.09.02.00","v2024.08.26.00","v2024.08.19.00","v2024.08.12.00","v2024.08.05.00","v2024.07.29.00","v2024.07.22.00","v2024.07.15.00","v2024.07.08.00","v2024.07.01.00","v2024.06.24.00","v2024.06.17.00","v2024.06.10.00","v2024.06.03.00","v2024.05.27.00","v2024.05.20.00","v2024.05.13.00","v2024.05.06.00","v2024.05.02.00","v2024.04.29.00","v2024.04.22.00","v2024.04.15.00","v2024.04.08.00","v2024.04.01.00","v2024.03.25.00","v2024.03.18.00","v2024.03.11.00","v2024.03.04.00","v2024.02.26.00","v2024.02.19.00","v2024.02.12.00","v2024.02.05.00","v2024.01.29.00","v2024.01.22.00","v2024.01.15.00","v2024.01.08.00","v2024.01.01.00","v2023.12.25.00","v2023.12.18.00","v2023.12.11.00","v2023.12.04.00","v2023.11.27.00","v2023.11.20.00","v2023.11.13.00","v2023.11.06.00","v2023.10.30.00","v2023.10.23.00","v2023.10.16.00","v2023.10.09.00","v2023.10.02.00","v2023.09.25.00","v2023.09.18.00","v2023.09.11.00","v2023.09.04.00","v2023.08.28.00","v2023.08.14.00","v2023.08.07.00","v2023.07.31.00","v2023.07.24.00","v2023.07.17.00","v2023.07.10.00","v2023.07.03.00","v2023.06.26.00","v2023.06.19.00","v2023.06.12.00","v2023.06.08.00","v2023.05.22.00","v2023.05.15.00","v2023.05.08.00","v2023.05.01.00","v2023.04.24.00","v2023.04.17.00","v2023.04.10.00","v2023.04.03.00","v2023.03.27.00","v2023.03.20.00","v2023.03.13.00","v2023.03.06.00","v2023.02.27.00","v2023.02.20.00","v2023.02.13.00","v2023.02.06.00","v2023.01.30.00","v2023.01.23.00","v2023.01.16.00","v2023.01.09.00","v2023.01.02.00","v2022.12.26.00","v2022.12.19.00","v2022.12.12.00","v2022.12.05.00","v2022.11.28.00","v2022.11.14.00","v2022.11.07.00","v2022.10.31.00","v2022.10.24.00","v2022.10.17.00","v2022.10.10.00","v2022.10.03.00","v2022.09.26.00","v2022.09.19.00","v2022.09.12.00","v2022.09.05.00","v2022.08.29.00","v2022.08.22.00","v2022.08.15.00","v2022.08.08.00","v2022.08.01.00","v2022.07.25.00","v2022.07.18.00","v2022.07.11.00","v2022.07.04.00","v2022.06.27.00","v2022.06.20.00","v2022.06.13.00","v2022.06.06.00","v2022.05.30.00","v2022.05.23.00","v2022.05.16.00","v2022.05.09.00","v2022.05.02.00","v2022.04.25.00","v2022.04.18.00","v2022.04.11.00","v2022.04.04.00","v2022.03.28.00","v2022.03.21.00","v2022.03.14.00","v2022.03.07.00","v2022.02.28.00","v2022.02.21.00","v2022.02.14.00","v2022.02.07.00","v2022.01.31.00","v2022.01.24.00","v2022.01.17.00","v2022.01.10.00","v2022.01.03.00","v2021.12.27.00","v2021.12.20.00","v2021.12.13.00","v2021.12.06.00","v2021.11.29.00","v2021.11.15.00","v2021.11.08.00","v2021.11.01.00","v2021.10.25.00","v2021.10.18.00","v2021.10.11.00","v2021.10.04.00","v2021.09.27.00","v2021.09.20.00","v2021.09.13.00","v2021.09.06.00","v2021.08.30.00","v2021.08.23.00","v2021.08.02.00","v2021.07.22.00","v2021.07.20.00","v2021.07.19.00","v2021.07.12.00","v2021.07.05.00","v2021.06.28.00","v2021.06.21.00","v2021.06.14.00","v2021.06.07.00","v2021.05.31.00","v2021.05.24.00","v2021.05.17.00","v2021.05.10.00","v2021.05.03.00","v2021.04.26.00","v2021.04.19.00","v2021.04.12.00","v2021.04.05.00","v2021.03.29.00","v2021.03.22.00","v2021.03.15.00","v2021.03.01.00","v2021.02.22.00","v2021.02.15.00","v2021.02.08.00","v2021.02.01.00","v2021.01.25.00","v2021.01.18.00","v2021.01.11.00","v2021.01.04.00","v2020.12.28.00","v2020.12.21.00","v2020.12.14.00","v2020.12.07.00","v2020.11.30.00","v2020.11.23.00","v2020.11.16.00","v2020.11.09.00","v2020.11.02.00","v2020.10.26.00","v2020.10.19.00","v2020.10.12.00","v2020.10.05.00","v2020.09.28.00","v2020.09.21.00","v2020.09.14.00","v2020.09.07.00","v2020.08.31.00","v2020.08.24.00","v2020.08.17.00","v2020.08.10.00","v2020.08.03.00","v2020.07.27.00","v2020.07.20.00","v2020.07.13.00","v2020.07.06.00","v2020.06.29.00","v2020.06.15.00","v2020.06.08.00","v2020.06.01.00","v2020.05.25.00","v2020.05.18.00","v2020.05.11.00","v2020.05.04.00","v2020.04.27.00","v2020.04.20.00","v2020.04.13.00","v2020.04.06.00","v2020.03.30.00","v2020.03.23.00","v2020.03.16.00","v2020.03.09.00","v2020.03.02.00","v2020.02.24.00","v2020.02.17.00","v2020.02.10.00","v2020.02.03.00","v2020.01.27.00","v2020.01.20.00","v2020.01.13.00","v2020.01.06.00","v2019.12.30.00","v2019.12.23.00","v2019.12.16.00","v2019.12.09.00","v2019.12.06.00","v2019.12.02.00","v2019.11.11.00","v2019.11.04.00","v2019.10.28.00","v2019.10.21.00","v2019.10.14.00","v2019.10.07.00","v2019.09.30.00","v2019.09.23.00","v2019.09.16.00","v2019.09.09.00","v2019.09.02.00","v2019.08.26.00","v2019.08.19.00","v2019.08.12.00","v2019.08.05.00","v2019.07.29.00","v2019.07.22.00","v2019.07.15.00","v2019.07.08.00","v2019.07.01.00","v2019.06.24.00","v2019.06.17.00","v2019.06.10.00","v2019.06.03.00","v2019.05.27.00","v2019.05.20.00","v2019.05.13.00","v2019.05.06.00","v2019.04.29.00","v2019.04.22.00","v2019.04.15.00","v2019.04.08.00","v2019.04.01.00","v2019.03.25.00","v2019.03.18.00","v2019.03.04.00","v2019.02.25.00","v2019.02.18.00","v2019.02.11.00","v2019.02.04.00","v2019.01.28.00","v2019.01.21.00","v2019.01.14.00","v2019.01.07.00","v2018.12.31.00","v2018.12.24.00","v2018.12.17.00","v2018.12.10.00","v2018.12.03.00","v2018.11.26.00","v2018.11.19.00","v2018.11.12.00","v2018.11.05.00","v2018.10.29.00","v2018.10.22.00","v2018.10.15.00","v2018.10.08.00","v2018.10.01.00","v2018.09.24.00","v2018.09.17.00","v2018.09.10.00","v2018.09.03.00","v2018.08.27.00","v2018.08.20.00","v2018.08.13.00","v2018.08.06.00","v2018.07.30.00","v2018.07.23.00","v2018.07.16.00","v2018.07.09.00","v2018.07.02.00","v2018.06.25.00","v2018.06.18.00","v2018.06.11.00","v2018.06.04.00","v2018.05.28.00","v2018.05.21.00","v2018.05.14.00","v2018.05.07.00","v2018.04.30.00","v2018.04.23.00","v2018.04.16.00","v2018.04.09.00","v2018.04.02.00","v2018.03.26.00","v2018.03.19.00","v2018.03.12.00","v2018.03.05.00","v2018.02.26.00","v2018.02.19.00","v2018.02.12.00","v2018.02.05.00","v2018.01.29.00","v2018.01.22.00","v2018.01.15.00","v2018.01.08.00","v2018.01.01.00","v2017.12.25.00","v2017.12.18.00","v2017.12.11.00","v2017.12.04.00","v2017.11.27.00","v2017.11.20.00","v2017.11.13.00","v2017.11.06.00","v2017.10.30.00","v2017.10.23.00","v2017.10.16.00","v2017.10.09.00","v2017.10.02.00","v2017.09.25.00","v2017.09.18.00","v2017.09.11.00","v2017.09.04.00","v2017.08.28.00","v2017.08.21.00","v2017.08.14.00","v2017.08.07.00","v2017.07.31.00","v2017.07.24.00","v2017.07.17.00","v2017.07.10.00","v2017.07.03.00","v2017.06.26.00","v2017.06.19.00","v2017.06.12.00","v2017.06.05.00","v2017.05.29.00","v2017.05.22.00","v2017.05.15.00","v2017.05.08.00","v2017.05.01.00","v2017.04.24.00","v2017.04.17.00","v2017.04.10.00","v2017.04.03.00","v2017.03.27.00","v2017.03.20.00","v2017.03.13.00","v2017.03.06.00","v2017.01.30.00","v2017.01.23.00","v2017.01.16.00","v0.32.0","v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0"],"database_specific":{"vanir_signatures_modified":"2026-11-14T07:06:18Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-121737.json","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/session/test/HQUpstreamSessionTest.cpp"},"deprecated":false,"digest":{"line_hashes":["15034696452393211841554768339451873203","208994346614362991279822127446486830535","274306907101058158645269473373987980471","158238559822750169715013775130111502368","151182585805184299005336160728819688451","255636853528261707576049265355365963658","8104838092709710033032039945157147442"],"threshold":0.9},"id":"CVE-2026-121737-00114310"},{"id":"CVE-2026-121737-066c888a","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f","target":{"file":"proxygen/lib/http/codec/CodecProtocol.cpp"},"deprecated":false,"digest":{"line_hashes":["120832210217008204836929388756514645713","159252836740926369277629891281701458093","333497881097752720651663984045673532143","70880031654253939927984855275930767635","162807726032668408982064363330342221596","64917593198942059291694904574233649449","317932258924868199556618857736548251543","334603663475825659085886200816285279930","223382478532419730663943772010867117841","167761590949481307043995465779425574633","97437668755309452765214511989157650563","332555766415751250715510052133614188542"],"threshold":0.9}},{"source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/compress/QPACKDecoder.cpp"},"deprecated":false,"digest":{"line_hashes":["287001967412217098684942290369719797949","237872624600714707219241888303262109311","243933686684997671109000521393769353301","149105204139915179548261683295717838084","269521037402280809290562557586858631905","98844320299112489522502320625183295536","289513442774888620851153565618322273643","243680836823114681615673443819198296465","227534935142233712894307241190839302375","274525032746363302937206061235979785167","60292213620216227282785687663636767486","65239146081331835785394003911369108619","6899282088322200694362392710694028356"],"threshold":0.9},"id":"CVE-2026-121737-091ac258","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["265711761104519347277227115816002992366","54892006895636261037347289204119361361","158088364005043190638776825223043850272","41563016314375245028820693639900290299","52800034147685568674182387141456586746","207210832092338079484920636160798897861","184282822346797199488937993833802167149","155211047298646513307493625259592823069","183114251480494516783272189397212733704","300510567374350172433622580443914681549","200631720477732093720648232322288787780","151010157494970858070719498202439842993","179719236570132225225638568346316861418","255891987415122473171266570122129643348","33302757671262361576562556974441532026","275141671524694272399191714039162532307","204390478324635094376768506062140913943"],"threshold":0.9},"id":"CVE-2026-121737-1aff9db3","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/test/HQCodecTest.cpp"},"deprecated":false},{"source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/compress/HPACKDecodeBuffer.cpp","function":"HPACKDecodeBuffer::decodeLiteral"},"deprecated":false,"digest":{"function_hash":"325402957006615756555670716191282297517","length":1181},"id":"CVE-2026-121737-2acd9e12","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/HQStreamCodec.cpp"},"deprecated":false,"digest":{"line_hashes":["96966570320052621831406393455846448412","143275295886896234662816618570975721554","339431619489076674361650038658648994985","206221176283277338109420245735815081108","250064693292786324715833489870495446303","220568849484258034636347125696091751984"],"threshold":0.9},"id":"CVE-2026-121737-31f907e6"},{"digest":{"function_hash":"111158673403414875753748686220214479093","length":782},"id":"CVE-2026-121737-3e1dfa32","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f","target":{"function":"serverAcceptedUpgrade","file":"proxygen/lib/http/codec/CodecProtocol.cpp"},"deprecated":false},{"target":{"function":"HQSession::resumeReads","file":"proxygen/lib/http/session/HQSession.cpp"},"deprecated":false,"digest":{"function_hash":"221568850615610200701991242945273129912","length":268},"id":"CVE-2026-121737-4e5a0a0f","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/session/HQSession.cpp","function":"HQSession::HQStreamTransportBase::onHeadersComplete"},"deprecated":false,"digest":{"function_hash":"302746580116567703709293970729565343262","length":3067},"id":"CVE-2026-121737-4e7cab25"},{"signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"function":"HQSession::HQStreamTransportBase::onError","file":"proxygen/lib/http/session/HQSession.cpp"},"deprecated":false,"digest":{"length":1706,"function_hash":"311003059372496172768746897583919653067"},"id":"CVE-2026-121737-56a31e59","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/HQFramedCodec.cpp","function":"HQFramedCodec::onFramedIngress"},"deprecated":false,"digest":{"function_hash":"190377351879847535831805923577696856146","length":2522},"id":"CVE-2026-121737-5b1e50e7","signature_type":"Function"},{"source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/coro/test/HTTPDownstreamCoroSessionTests.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["103678433281190198118171387768567502371","268948592876150993162450674411262078161","144334804806277610028018624246878816273"]},"id":"CVE-2026-121737-65d34c50","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/coro/HTTPCoroSession.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["161164760423200231512550607833656979702","214133428852083202025273119550177696782","184292156082261461124250087159340912527","140344860192762763754050543247265915402","90387822815796978355614377896423732735","127836922660475367557178819070616580877","294610807192964461107747537270380050590","158636533068045620634699994934709551278"]},"id":"CVE-2026-121737-67931899","signature_type":"Line"},{"digest":{"function_hash":"209015504572731264237632493680306863017","length":1121},"id":"CVE-2026-121737-6912642d","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"function":"HQFramedCodec::parseFrame","file":"proxygen/lib/http/codec/HQFramedCodec.cpp"},"deprecated":false},{"source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"function":"HTTPCoroSession::resetOpenStreams","file":"proxygen/lib/http/coro/HTTPCoroSession.cpp"},"deprecated":false,"digest":{"function_hash":"135004055046642845355867781534296428729","length":312},"id":"CVE-2026-121737-73dfacfc","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"function":"HQSession::resumeReads","file":"proxygen/lib/http/session/HQSession.cpp"},"deprecated":false,"digest":{"function_hash":"333993192566343569348016129672636814173","length":188},"id":"CVE-2026-121737-7954e97c","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/session/test/HQDownstreamSessionTest.cpp","function":"TEST_P"},"deprecated":false,"digest":{"length":473,"function_hash":"115484644457990704286876614324969094998"},"id":"CVE-2026-121737-7b40a583","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["265194875211338502878009567027359929128","182056287176001771236059684980906694328","255166599260276495478373859549805645058","79482160528464330370453831348795385174","337905027233113547696521273854861284718","109370948819901109764678143400501406281","204487516539173877567077377823064165850","100645640887425275624448214043592454419","55929671363355560172856562916347247407","212303097328113326261462205354350652898","283360861187905051839747190629382243588","141028017462017802431054552768054707676","268886087866226998902332102187631505599"]},"id":"CVE-2026-121737-83b8e54e","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/compress/HPACKDecodeBuffer.cpp"}},{"target":{"file":"proxygen/lib/http/codec/HQStreamCodec.h"},"deprecated":false,"digest":{"line_hashes":["238529013326343877278991129352357524643","227920204734732082914316404549882112505","53447088959292226813293510305413775520","245532474185276155679437430902801347225"],"threshold":0.9},"id":"CVE-2026-121737-90f75d7c","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["231351884042265946860809917090203324576","137102956104882346008960217902877051947","23344192700825912429616617230267674908","205211788184107933652249686772058484055","184134869876781070424326021930923363750","157190664708256465356961680965217438603","131686119711051515999160380473114415073","232720626615781355200140362789087514999","186864427519449873094206205117918132322","184263563906305267907369490820355516579","312521738162539732589878553556386310778","257310540911225964514348660420799741744","97808484551154773624555208373411244707","54127396792960372578833582676137515895","270488952439598311086650609255281138540","106165769323625217212688860737457366163","86666852448713506249747711426841665241","6041214374138809883248000986360585960","194996897531412745952275535973865382453","170473484860343056779484888067445270896","97493072654464156939925039859094094760","119668700697571147732319404162635876591","121992365691087024018543351994914232216","280952471832160617791579997461519972534","75948803071768541535430971232341398516","228311876258154215436467657139083523379","95585082977766486578948437424384512502","237089707973951074310317306622683290235","283875209735479379825323736419352495827","117420394319655153855383117131566613347"]},"id":"CVE-2026-121737-922d7e42","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/session/HQSession.cpp"}},{"signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/compress/QPACKDecoder.cpp","function":"QPACKDecoder::decodeLiteralHeaderQ"},"deprecated":false,"digest":{"function_hash":"243176297844324118179794704587620681109","length":1861},"id":"CVE-2026-121737-a1107f2f","signature_type":"Function"},{"id":"CVE-2026-121737-a4868833","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f","target":{"file":"proxygen/lib/http/HTTPMessage.cpp"},"deprecated":false,"digest":{"line_hashes":["312155550928927255893469703277168117988","248675243967843624643458598405024183969","179847879417664029073656960364731645261","245906313013601483436184520568558463086","181144524208149827146788135445906085529","110343948290209898197782169351671267910","22255121213860363754308742067466036169","292503812642743045050115086609598752769","125411119569222004795190799668909327575","127034901789409641374600108731738686850","154242359963032726907912587127331936498","76219342895628318717830310714228406187","41264377699339183930845119355778530576","34820532339038654751733407138666352717","236755422707747602155443276263316999065","68788116463241980996291900062125259675","69397966171340857351266929288066497463","48557193161680982182028241340322461578"],"threshold":0.9}},{"target":{"file":"proxygen/lib/http/codec/compress/test/QPACKContextTests.cpp"},"deprecated":false,"digest":{"line_hashes":["306219039822168734648673640736506803107","101623106194266471933618908472160666351","44773911992587086442744793510620120239"],"threshold":0.9},"id":"CVE-2026-121737-b3d400ab","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781"},{"deprecated":false,"digest":{"line_hashes":["18629590188575873428942784772222312760","334131797872692092779978404912365928003","139395786873620821017690787134486328846"],"threshold":0.9},"id":"CVE-2026-121737-c1cf6ce2","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/session/test/HQDownstreamSessionTest.h"}},{"target":{"file":"proxygen/lib/http/session/test/HQUpstreamSessionTest.cpp","function":"TEST_P"},"deprecated":false,"digest":{"function_hash":"240785928022020584813835574434933258146","length":1159},"id":"CVE-2026-121737-c2b5fa01","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781"},{"deprecated":false,"digest":{"line_hashes":["113806203052946113194428803355121634473","81799554579836300664746920201240004271","297450490686111204395104973799305063691","221086850303680611809109926487791120130","43460050797153147672692060898329127174","254124345353716176244876177793491803271","143633288569521338537780681907577365541","326443139636391086608187471729211774228","166432743547132533310176519012157109903","229578062008879367133039844891107592926","114463740357823617807920335703437663255","277098449388886517893632635887853670965","308701814867881620845543441895777256797","191897235294452925238042056960313775926","166210839608611050168050155486000626230","88654300159261741299189289289356726159","47668961855141768877893949754424577034","136805887782680805332271406144774413820","232181181075519320911183640213909270045","327663973234664113885808357895671392306","279581511424740506121080700003226672208","338523927605373046755153849635658117284","67044534825671385019618988261401795505","219847791138650783966246017203091032179","72786567075134789981872876967408393459","63197085037280672761261619737227590517","319525884610172342876902294021179717668","310153327731097614010396837287914821591","301919934510374427332992842148573871908","232839970309398886422259842177543858857","93629154327600513521687771191937942563","59754015839841415533055993987024785971","165375280741986519406584364995003291593","160203754356214441259497463568937609961","193782826099231750774659323426512787632","11776401016763583739215025936483012782","124903148717950879031274528003868147512","221608112779239682135385206484301644586","284975895391807861812087249060882886263","61121098812433399058982399349594329352","116253373356051213149753594220589655815","291324068965236365235911211472189580906","310064074024255843249051262065416679816","121281766859789046122197245250984548060","220891932407826579330465846494345012816","205624838294061204991737816640956422311","256770861806075418766849660432652464350","165367278138629740417609653387382055092","282581040689382196494469728419783021231","321712017153127324769372287944343235181","50886433039341969003152408546583196924","266314189557357984363924266591214837374","174897794123973076413853837671073353397","96049984329209610832612413999365161080","28420277373371569973444061321594103514","117441967083274303676909916980118651926","79081376372490393181753956597638438384"],"threshold":0.9},"id":"CVE-2026-121737-c450be90","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/HQFramedCodec.cpp"}},{"target":{"file":"proxygen/lib/http/session/HQSession.h"},"deprecated":false,"digest":{"line_hashes":["208699403997712542113703805166235540156","44937344481708976485463998735782996146","292966294185446678310785364817116991094","3490116130655899683212162121293026270","280064756223749662254434557384684906293","32481570581467945781911084535178013009","263961084022990270116094864029068724758","304068786725400431985776783315302384516","23930623389081448883071550052432179713","98337061100758625796611922347989656320","262786439605282993502599612249734023367","199347307930831607071471492745885677227","299257000026989466302744036003419605618","106812626895159574889998313939873417097","189959101725350703605214275540792572833","130206257354859316574418676839053730078"],"threshold":0.9},"id":"CVE-2026-121737-cbb94523","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781"},{"source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/test/HQCodecTest.cpp","function":"qpackTest"},"deprecated":false,"digest":{"function_hash":"42427938797419812805908060076325456622","length":2053},"id":"CVE-2026-121737-d8fcd2ef","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["28540781282860012090497403743475805418","7075047224141832112458172595594974409","56426454152518380346587885971786309624","83851390459640073109456941884975011108","125372405082601462211602327081611124956","985060381627456831808813746591427198","255398917104308844422524736857908727337","256275182324214577562060487047174180586","78522060048191852198821617687057720077","9669762096361892876942850273720097214","271696943468371960334389273058643495924","115232026535158015942455894727133003511","202663739105948037159955792139458373014","11598971029321488092007012780793125057","179165495508061001144163948773688922443","144128038894769275202752342352878459007","59028049359917559050142360009536965000"]},"id":"CVE-2026-121737-da1efa62","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/codec/HQFramedCodec.h"},"deprecated":false},{"target":{"file":"proxygen/lib/http/session/HQSession.cpp","function":"HQSession::HQStreamTransportBase::initCodec"},"deprecated":false,"digest":{"function_hash":"122770666403599124928422094142104325260","length":785},"id":"CVE-2026-121737-ddac8a4e","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781"},{"digest":{"threshold":0.9,"line_hashes":["227669475324487839766187766872341664757","184192760736917158679264329046762201803","11023238191459862037943363264158575462","178126099518797993717776224784624979086"]},"id":"CVE-2026-121737-ded87723","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f","target":{"file":"proxygen/httpserver/samples/masque/MasqueClient.cpp"},"deprecated":false},{"source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/session/test/HQSessionTestCommon.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["188304645056507728196755512158359072857","246694067129469066357770195298686857791","43979441029657633426912284755309368778","272458398859274135615033929829523781318","13564099680588233612918689912856448987","180990305846041504291771159781941364287","113650479705734737627864818782014541783"]},"id":"CVE-2026-121737-e20eb480","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-121737-f522fb74","signature_type":"Line","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781","target":{"file":"proxygen/lib/http/session/test/HQDownstreamSessionTest.cpp"},"deprecated":false,"digest":{"line_hashes":["26631180975222631569346219644770718437","82527020875030830703102966129510581967","124039816100421011610057218327843705619","87312310490147662812403196152656262500","169842685677156272488662868878246730466","33846132979610988196349542659335858008","145833571507394596956983303247254589443","329969673009363395841668049508462571321","318690021318339407097045177851511235914","233896465181738706499321488466891692707","279449412206872906884460477138547798605","139679714464040682807339359951722245608","117561968834163658646847064007710552186","203502341891936082882742946236296216332","320469525186466834954482294582857110184","94026016053001756692430244113521847988","25973054638391614856268943556634920284","259916494756285476272959179503692283403","269645539985011643701369749019676954064","201850928973058621869827777569147106100","267781685977541342228639827689189928674","102848196630890516373305477857958031817"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"84378633117195407713217986281247997951","length":2861},"id":"CVE-2026-121737-fdb835d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/meta/proxygen/commit/0c2a067ec61de88f6199b93c867a358a2b2adc9f","target":{"file":"proxygen/httpserver/samples/masque/MasqueClient.cpp","function":"main"}}]}}],"schema_version":"1.9.2"}