{"id":"CVE-2026-44909","details":"Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected.","modified":"2026-07-26T03:40:48.675702Z","published":"2026-07-23T17:16:28.170Z","references":[{"type":"FIX","url":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/proxygen","events":[{"introduced":"7e2a49cac930252eb107c229f338a4eaf392501f"},{"fixed":"748848b045df0c16d31687b1b72f3fa0d7fd800e"},{"fixed":"f28742f21f7022c261b7620d4e6b20d82b6cff72"}],"database_specific":{"extracted_events":[{"introduced":"v2017.01.16.00"},{"fixed":"v2026.07.20.00"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2026.07.13.00","v2026.07.06.00","v2026.06.29.00","v2026.06.22.00","v2026.06.15.00","v2026.06.08.00","v2026.06.01.00","v2026.05.25.00","v2026.05.18.00","v2026.05.11.00","v2026.05.04.00","v2026.04.27.00","v2026.04.20.00","v2026.04.13.00","v2026.04.06.00","v2026.03.30.00","v2026.03.23.00","v2026.03.16.00","v2026.03.09.00","v2026.03.02.00","v2026.02.23.00","v2026.02.16.00","v2026.02.09.00","v2026.02.02.00","v2026.01.26.00","v2026.01.19.00","v2026.01.12.00","v2026.01.05.00","v2025.12.29.00","v2025.12.22.00","v2025.12.15.00","v2025.12.02.00","v2025.12.01.00","v2025.11.24.00","v2025.11.17.00","v2025.11.10.00","v2025.11.03.00","v2025.10.27.00","v2025.10.20.00","v2025.10.13.00","v2025.10.06.00","v2025.09.29.00","v2025.09.22.00","v2025.09.15.00","v2025.09.08.00","v2025.09.01.00","v2025.08.25.00","v2025.08.18.00","v2025.08.11.00","v2025.08.04.00","v2025.07.28.00","v2025.07.21.00","v2025.07.14.00","v2025.07.07.00","v2025.06.30.00","v2025.06.23.00","v2025.06.16.00","v2025.06.09.00","v2025.06.02.00","v2025.05.26.00","v2025.05.19.00","v2025.05.12.00","v2025.05.05.00","v2025.04.28.00","v2025.04.21.00","v2025.04.14.00","v2025.04.07.00","v2025.03.31.00","v2025.03.24.00","v2025.03.17.00","v2025.03.10.00","v2025.03.03.00","v2025.02.24.00","v2025.02.17.00","v2025.02.10.00","v2025.02.03.00","v2025.01.27.00","v2025.01.20.00","v2025.01.13.00","v2025.01.06.00","v2024.12.30.00","v2024.12.23.00","v2024.12.16.00","v2024.12.09.00","v2024.12.02.00","v2024.11.25.00","v2024.11.18.00","v2024.11.11.00","v2024.11.04.00","v2024.10.28.00","v2024.10.21.00","v2024.10.14.00","v2024.10.07.00","v2024.09.30.00","v2024.09.23.00","v2024.09.16.00","v2024.09.09.00","v2024.09.02.00","v2024.08.26.00","v2024.08.19.00","v2024.08.12.00","v2024.08.05.00","v2024.07.29.00","v2024.07.22.00","v2024.07.15.00","v2024.07.08.00","v2024.07.01.00","v2024.06.24.00","v2024.06.17.00","v2024.06.10.00","v2024.06.03.00","v2024.05.27.00","v2024.05.20.00","v2024.05.13.00","v2024.05.06.00","v2024.05.02.00","v2024.04.29.00","v2024.04.22.00","v2024.04.15.00","v2024.04.08.00","v2024.04.01.00","v2024.03.25.00","v2024.03.18.00","v2024.03.11.00","v2024.03.04.00","v2024.02.26.00","v2024.02.19.00","v2024.02.12.00","v2024.02.05.00","v2024.01.29.00","v2024.01.22.00","v2024.01.15.00","v2024.01.08.00","v2024.01.01.00","v2023.12.25.00","v2023.12.18.00","v2023.12.11.00","v2023.12.04.00","v2023.11.27.00","v2023.11.20.00","v2023.11.13.00","v2023.11.06.00","v2023.10.30.00","v2023.10.23.00","v2023.10.16.00","v2023.10.09.00","v2023.10.02.00","v2023.09.25.00","v2023.09.18.00","v2023.09.11.00","v2023.09.04.00","v2023.08.28.00","v2023.08.14.00","v2023.08.07.00","v2023.07.31.00","v2023.07.24.00","v2023.07.17.00","v2023.07.10.00","v2023.07.03.00","v2023.06.26.00","v2023.06.19.00","v2023.06.12.00","v2023.06.08.00","v2023.05.22.00","v2023.05.15.00","v2023.05.08.00","v2023.05.01.00","v2023.04.24.00","v2023.04.17.00","v2023.04.10.00","v2023.04.03.00","v2023.03.27.00","v2023.03.20.00","v2023.03.13.00","v2023.03.06.00","v2023.02.27.00","v2023.02.20.00","v2023.02.13.00","v2023.02.06.00","v2023.01.30.00","v2023.01.23.00","v2023.01.16.00","v2023.01.09.00","v2023.01.02.00","v2022.12.26.00","v2022.12.19.00","v2022.12.12.00","v2022.12.05.00","v2022.11.28.00","v2022.11.14.00","v2022.11.07.00","v2022.10.31.00","v2022.10.24.00","v2022.10.17.00","v2022.10.10.00","v2022.10.03.00","v2022.09.26.00","v2022.09.19.00","v2022.09.12.00","v2022.09.05.00","v2022.08.29.00","v2022.08.22.00","v2022.08.15.00","v2022.08.08.00","v2022.08.01.00","v2022.07.25.00","v2022.07.18.00","v2022.07.11.00","v2022.07.04.00","v2022.06.27.00","v2022.06.20.00","v2022.06.13.00","v2022.06.06.00","v2022.05.30.00","v2022.05.23.00","v2022.05.16.00","v2022.05.09.00","v2022.05.02.00","v2022.04.25.00","v2022.04.18.00","v2022.04.11.00","v2022.04.04.00","v2022.03.28.00","v2022.03.21.00","v2022.03.14.00","v2022.03.07.00","v2022.02.28.00","v2022.02.21.00","v2022.02.14.00","v2022.02.07.00","v2022.01.31.00","v2022.01.24.00","v2022.01.17.00","v2022.01.10.00","v2022.01.03.00","v2021.12.27.00","v2021.12.20.00","v2021.12.13.00","v2021.12.06.00","v2021.11.29.00","v2021.11.15.00","v2021.11.08.00","v2021.11.01.00","v2021.10.25.00","v2021.10.18.00","v2021.10.11.00","v2021.10.04.00","v2021.09.27.00","v2021.09.20.00","v2021.09.13.00","v2021.09.06.00","v2021.08.30.00","v2021.08.23.00","v2021.08.02.00","v2021.07.22.00","v2021.07.20.00","v2021.07.19.00","v2021.07.12.00","v2021.07.05.00","v2021.06.28.00","v2021.06.21.00","v2021.06.14.00","v2021.06.07.00","v2021.05.31.00","v2021.05.24.00","v2021.05.17.00","v2021.05.10.00","v2021.05.03.00","v2021.04.26.00","v2021.04.19.00","v2021.04.12.00","v2021.04.05.00","v2021.03.29.00","v2021.03.22.00","v2021.03.15.00","v2021.03.01.00","v2021.02.22.00","v2021.02.15.00","v2021.02.08.00","v2021.02.01.00","v2021.01.25.00","v2021.01.18.00","v2021.01.11.00","v2021.01.04.00","v2020.12.28.00","v2020.12.21.00","v2020.12.14.00","v2020.12.07.00","v2020.11.30.00","v2020.11.23.00","v2020.11.16.00","v2020.11.09.00","v2020.11.02.00","v2020.10.26.00","v2020.10.19.00","v2020.10.12.00","v2020.10.05.00","v2020.09.28.00","v2020.09.21.00","v2020.09.14.00","v2020.09.07.00","v2020.08.31.00","v2020.08.24.00","v2020.08.17.00","v2020.08.10.00","v2020.08.03.00","v2020.07.27.00","v2020.07.20.00","v2020.07.13.00","v2020.07.06.00","v2020.06.29.00","v2020.06.15.00","v2020.06.08.00","v2020.06.01.00","v2020.05.25.00","v2020.05.18.00","v2020.05.11.00","v2020.05.04.00","v2020.04.27.00","v2020.04.20.00","v2020.04.13.00","v2020.04.06.00","v2020.03.30.00","v2020.03.23.00","v2020.03.16.00","v2020.03.09.00","v2020.03.02.00","v2020.02.24.00","v2020.02.17.00","v2020.02.10.00","v2020.02.03.00","v2020.01.27.00","v2020.01.20.00","v2020.01.13.00","v2020.01.06.00","v2019.12.30.00","v2019.12.23.00","v2019.12.16.00","v2019.12.09.00","v2019.12.06.00","v2019.12.02.00","v2019.11.11.00","v2019.11.04.00","v2019.10.28.00","v2019.10.21.00","v2019.10.14.00","v2019.10.07.00","v2019.09.30.00","v2019.09.23.00","v2019.09.16.00","v2019.09.09.00","v2019.09.02.00","v2019.08.26.00","v2019.08.19.00","v2019.08.12.00","v2019.08.05.00","v2019.07.29.00","v2019.07.22.00","v2019.07.15.00","v2019.07.08.00","v2019.07.01.00","v2019.06.24.00","v2019.06.17.00","v2019.06.10.00","v2019.06.03.00","v2019.05.27.00","v2019.05.20.00","v2019.05.13.00","v2019.05.06.00","v2019.04.29.00","v2019.04.22.00","v2019.04.15.00","v2019.04.08.00","v2019.04.01.00","v2019.03.25.00","v2019.03.18.00","v2019.03.04.00","v2019.02.25.00","v2019.02.18.00","v2019.02.11.00","v2019.02.04.00","v2019.01.28.00","v2019.01.21.00","v2019.01.14.00","v2019.01.07.00","v2018.12.31.00","v2018.12.24.00","v2018.12.17.00","v2018.12.10.00","v2018.12.03.00","v2018.11.26.00","v2018.11.19.00","v2018.11.12.00","v2018.11.05.00","v2018.10.29.00","v2018.10.22.00","v2018.10.15.00","v2018.10.08.00","v2018.10.01.00","v2018.09.24.00","v2018.09.17.00","v2018.09.10.00","v2018.09.03.00","v2018.08.27.00","v2018.08.20.00","v2018.08.13.00","v2018.08.06.00","v2018.07.30.00","v2018.07.23.00","v2018.07.16.00","v2018.07.09.00","v2018.07.02.00","v2018.06.25.00","v2018.06.18.00","v2018.06.11.00","v2018.06.04.00","v2018.05.28.00","v2018.05.21.00","v2018.05.14.00","v2018.05.07.00","v2018.04.30.00","v2018.04.23.00","v2018.04.16.00","v2018.04.09.00","v2018.04.02.00","v2018.03.26.00","v2018.03.19.00","v2018.03.12.00","v2018.03.05.00","v2018.02.26.00","v2018.02.19.00","v2018.02.12.00","v2018.02.05.00","v2018.01.29.00","v2018.01.22.00","v2018.01.15.00","v2018.01.08.00","v2018.01.01.00","v2017.12.25.00","v2017.12.18.00","v2017.12.11.00","v2017.12.04.00","v2017.11.27.00","v2017.11.20.00","v2017.11.13.00","v2017.11.06.00","v2017.10.30.00","v2017.10.23.00","v2017.10.16.00","v2017.10.09.00","v2017.10.02.00","v2017.09.25.00","v2017.09.18.00","v2017.09.11.00","v2017.09.04.00","v2017.08.28.00","v2017.08.21.00","v2017.08.14.00","v2017.08.07.00","v2017.07.31.00","v2017.07.24.00","v2017.07.17.00","v2017.07.10.00","v2017.07.03.00","v2017.06.26.00","v2017.06.19.00","v2017.06.12.00","v2017.06.05.00","v2017.05.29.00","v2017.05.22.00","v2017.05.15.00","v2017.05.08.00","v2017.05.01.00","v2017.04.24.00","v2017.04.17.00","v2017.04.10.00","v2017.04.03.00","v2017.03.27.00","v2017.03.20.00","v2017.03.13.00","v2017.03.06.00","v2017.01.30.00","v2017.01.23.00","v2017.01.16.00"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44909.json","vanir_signatures_modified":"2026-07-26T03:40:48Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["332408444260321538646249096046650660852","58514956720517978933535565216641678999","156097465629833341435506398996225755779","73331317778703964331353122194347073024","226636281879201856080895608111154559104","89142490694190057824407952579314017713","311660088383094195931520276719737626243","14945030273901739245730622259122119202","278659671168714750455255070980927752459","232431631301702764280250123360325111630","27772813169585031140222029841800433651","22886138148176856191852028739996896386","165410209629101710679251018857771152553","183657497971688981624538882001518272762","214451281174138073733747298891427281179","51054759617272962863464063205081920272","111410300520222265392822717869924605554","182317225123580957627770355275640081162","137144968512691148361073539413622657533"],"threshold":0.9},"id":"CVE-2026-44909-0e67f14c","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HTTPSession.cpp"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/test/HQDownstreamSessionTest.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["27091189217822543432435570647960092700","269690233450692845750051369512974821762","30182906722407926987789894111041206514"]},"id":"CVE-2026-44909-1d9ad326"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HQSession.cpp"},"deprecated":false,"digest":{"line_hashes":["84986315785992090107585643421901387627","68801028107220005876814404938533132804","248775701739052610912280288511567829691","240137758134351427998854742227411256436"],"threshold":0.9},"id":"CVE-2026-44909-28050616"},{"deprecated":false,"digest":{"function_hash":"288147410430390208405575415835246111440","length":351},"id":"CVE-2026-44909-28a46999","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"function":"HQUpstreamSession::detachThreadLocals","file":"proxygen/lib/http/session/HQUpstreamSession.cpp"}},{"id":"CVE-2026-44909-652fc484","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HTTPSession.h"},"deprecated":false,"digest":{"line_hashes":["120596880918706797407089570092337791980","189497348339643203543550696546704466928","319911048285961567220352429005583194685","13985038475746957881780556767970980320","211616190698236988429216941604009886756","113349371494865028240009061056211828432","13312276686263909051769410381527999798","171185540871456745204837264858771045601","303006563007506719384530270562984154031"],"threshold":0.9}},{"id":"CVE-2026-44909-6531a1f4","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/test/HTTPDownstreamSessionTest.cpp"},"deprecated":false,"digest":{"line_hashes":["197402501449329962171262229851432913294","296978667893364613338966926994061735470","209421745458046637457811942017132554328","333300107649384890542906881984493459191","91819851903319491155975541648953382882","328175479523849579248445488426415142466"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["175993130971566371558164956763856999361","65269507789533702678480714200884305680","300392924363625873799822615296413984597","231557400799777326198870639267365432993","141305891711793661976299891633188659839","56374552044710294952779282582637214274","12672402629643670534315243358446483381","312700476328206094765829489298989542853","52930060093873977690091377133190447588","57418288617408411471158244589365562075","73752636206581848626550542512028826214","306214066860876271657058838589551637083","100194951343416203955711790507901702789"],"threshold":0.9},"id":"CVE-2026-44909-74ea50f9","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HTTPSessionBase.h"}},{"id":"CVE-2026-44909-782ee4c6","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HQSession.cpp","function":"HQSession::handleWrite"},"deprecated":false,"digest":{"function_hash":"285499734540070789905259783694771075232","length":780}},{"deprecated":false,"digest":{"function_hash":"67643622878778609651646295890916443773","length":244},"id":"CVE-2026-44909-7df4a09d","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HTTPSessionBase.cpp","function":"HTTPSessionBase::~HTTPSessionBase"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HTTPSessionBase.cpp","function":"HTTPSessionBase::updateWriteBufSize"},"deprecated":false,"digest":{"length":312,"function_hash":"304992390366627615028756558319152105896"},"id":"CVE-2026-44909-7e0621e1"},{"deprecated":false,"digest":{"function_hash":"237939098775682782604771145686842165573","length":448},"id":"CVE-2026-44909-a3dc83ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"function":"HTTPSessionBase::HTTPSessionBase","file":"proxygen/lib/http/session/HTTPSessionBase.cpp"}},{"deprecated":false,"digest":{"function_hash":"80771559354866433016239105831732675736","length":501},"id":"CVE-2026-44909-b6fee96c","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HTTPUpstreamSession.cpp","function":"HTTPUpstreamSession::detachThreadLocals"}},{"signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HTTPUpstreamSession.cpp"},"deprecated":false,"digest":{"line_hashes":["137206961227123421358324455306401361070","163496075743221997629217668409713670050","270620552304858847959464371092614027299","316938990393907395951186029300548741716"],"threshold":0.9},"id":"CVE-2026-44909-d05dbfeb","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["132446301996966035610347237247842270068","82138451999803129614797688095745201006","314924068273005519814458228277160721391","254498948415905534371051752232647223722","84349837686088005550182205213881594133","129590689838331541839398894595988979288","294223610186645608115731797862083007137","337171001608051018900167244563617677038","144586673105553581556514414488487911338","311615363964801021791257368601640038511","139498477315009747147384525658773436985","228760549075698916018550277995512521226","144243755065398626143509911498232513934","225728891004793342779552288178806794713","170979415534328586414571561591656494217","5921563843315654895886777140099971544","103908967732217329267227864349317543341","161091156128843023890269003527490361171"],"threshold":0.9},"id":"CVE-2026-44909-d4db1b1f","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HTTPSessionBase.cpp"}},{"id":"CVE-2026-44909-e2c34d70","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/f28742f21f7022c261b7620d4e6b20d82b6cff72","target":{"file":"proxygen/lib/http/session/HQUpstreamSession.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["132353645309063301904098681869896571784","234053658843020341367866653383051434631","75888804995437442303510581913541191906","259053981195409545066686442874218387611"]}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}