{"id":"CVE-2026-84894","details":"In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.","modified":"2026-09-30T08:06:59.640071Z","published":"2026-09-28T19:16:50.213Z","references":[{"type":"ADVISORY","url":"https://www.facebook.com/security/advisories/cve-2026-84894"},{"type":"FIX","url":"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebookexperimental/moxygen","events":[{"introduced":"0"},{"fixed":"004123dd24c30dad6b649163575145f240dabc94"}],"database_specific":{"source":"REFERENCES"}}],"versions":["draft-12-stable","draft-08-stable","draft-07-stable"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84894.json","vanir_signatures_modified":"2026-09-30T08:06:59Z","vanir_signatures":[{"id":"CVE-2026-84894-1d900b53","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94","target":{"file":"moxygen/MoQSession.h"},"deprecated":false,"digest":{"line_hashes":["170911455317071165656593951946965204830","301265065837899781732992036484547666201","153320690110925779669964333532853794760","218545059036537395616170178461344686361","99857527424838480245131961382190893895","231649691860121436571327372752390295829","88796697806442171996789234546511947024","125062960545573178329924459624555313539","321556697423032579161759691339106254562","165449071393020916763908958264129990642","166684635912814243341374899383277459396","103324760454624561433280747620935777444","19221166480675779634224145652044306520","209962679788107213048582792139055026717","17093700932131512455133126788933259216","18279843521896459669542923272325763873","228617777500353824449627929395426551134","254444219817786317602537610059774007835","83157943276167125553037039351829365036","89629907532910060150759111752323882297","60342332080128759424029333600799624442","336732339966403960567388058804803594264","252819006966251769199157308355129519263","265692025606492618704107536204803850139","184026702705386057723223583286462509857","251173647230278461892017113652986114065","131940253864386300336927370980835576460","298658518914288335266414909877164126376","303275590206333832765985047839846059352","29008657001827757632286837760966608402","163863138908090549740089522650463863349"],"threshold":0.9}},{"source":"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94","target":{"file":"moxygen/MoQSession.cpp","function":"MoQSession::start"},"deprecated":false,"digest":{"function_hash":"95706840555774541445389021552469599307","length":860},"id":"CVE-2026-84894-52c5fddc","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94","target":{"file":"moxygen/MoQSession.cpp","function":"MoQSession::dataStreamReadLoop"},"deprecated":false,"digest":{"function_hash":"175171028297742042403827175562649632095","length":5417},"id":"CVE-2026-84894-886da4fe","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94","target":{"file":"moxygen/MoQSession.cpp","function":"MoQSession::replayBufferedUniStreams"},"deprecated":false,"digest":{"function_hash":"240252167403251495327003432963066834081","length":338},"id":"CVE-2026-84894-8c8d079b","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["116064157752364120127044256065532112937","168356028759187871765557620750374388496","285051713362136633476969194282080335590","139094068760388895115187496263543201193","197638502205683391208516033622318195988","36067494397542370962147849282913282163","228262231594574289477962564729504863253","31004973350275383326738594648826241004","88952118965132652911048955663246172191","209373993888354168827904229475776070550","324136120167814752586114894985802299171","167574065071495678468760380618285455304","234522166588909370141379869343388364070","3417825256757713067363085030087163440","2930817482673789948707935684738720597","196698614801207663242670622054745584728","65232541594751473780254481423474103547","79843767564435069742505847348428492262","68251095292276152182580316070606748941","270837644963353435482380644353923734728","173944498167823562322381703934529645695","134048633296047832614687367827073442555","337304136068735690276064459921088235968","293888536654803295051524489265278799115","35360088918780068886731883084782896914","148345659287620765579935554464162751522","339142064214764134484148629177368962548","83966617481088740025753991054851872763","310878151631664825850425187761016897354","301248738644119165673987653721529920567","112026667377895240216606713168039200360","261866684564814774664409983666961313085","280398119183425792365719964989274808883","235312707224940096289006707370750955686","32851483680537449747193856144774732309","147219199955605414510205038330304918404","222406320318109941725591453246552265475","329569569490802243294187729704473035894","19423343993667381699775238147557768836","20947755527929099738859497474032010516","173519761810706116510004570889240443208","236413439755068012043151068500751118198","13544732443644060000695368152024170140","120255083445053991378415833094885884693","256830222290749618555318993145714113313","173050264452565536251823630748965874384","293427839941528973140626096740018618628","29981293004809514581804948047459057405","220312391073571808748616171652409859814","205910927733747691473219686389784472871","92159301404329137936336825017919740461","108277477408141254943383247117708643925","245438820501476174942615197537686707555","303903670985663166784371544428076664565","293199646868018827255110886358931201902","229473029529972440005294754244372326503","264084360453516594652469412948522439153","4149016065515882141411592799304994493","61373493538857058772144941822344631762","17466776015859234988941910738688542460","333899415829505552047061280969895096781","194617971549972566170109785691917629972","216717783021993818867789658453751978574","37233484920676268729337709465558123062","332503467205210778752042273814703319074","110091386492463754496108508179352421993","195221543859851252310558832569696974458","313708146565702258610500019920097341240","148211299058778067114695017640142481490","337992742111431779582092069722999294042","229904613379503752425140551968131935312","314376896684719248937890302584598132242","195541695323572531463519741140042079454","62676240847438916978718677163426205940","131467209450056515723500560498679424308","326681104628170182519659182460871250997","234886890903788278996535405848920748068","295452050653169010592386299474913603329","230135102557756592225448332397153352026","69031815842810034695737892657731653367","236218929924835133198618369295734616308","179453704966134054362260398767157216589","132251115848091341936382334023478077488","191837295881187089986992037011858313470","70624865508949854483526020623820972507","101791635778337717903832350577928731788","2899089120093640328249489732751868682","89380427282882711354183496435899660590","94441976324320205019413652138843906404","47906825985541379527831727782492897203","168788439829007677000374742387377227342","89780040109577452548858644994662168173","244891821148708484509552597381432475576","44739139782848831293482480058494914287","339043377986478189257689619395059942322","168592933071727607396213373237811208666","67101498494223483821378085730111586102","126577828734647740259722894969033161101","277212631171125185600630758542957883344","280924047046557878479736376788756006945","330036025471371411431285291409977274223","68276458041344084883062999692331781124","211249257302679035243428167027908841737","173289477475688172633532275174437720827","27604062829728601995110600799892192347","318966381013963479972046290338824959578","45905158703076835821155097910835939883","199575750134862074814867361253979128008","257192955994448772272720933812648303647","72354625323238762643374386765417335523","89951399636153271840115743412503265632","230684146183848556637113160610055349871","35564542183876419353166514938574097539","75407180318704451699303769443305508093","82492669128795064022106410097784768352","309606207319415080742135757994729221718","206918212154516456091987498471380655808","199459160482610027770876388918172121697","226318765970628466983039404091495311276","337198941700410024123484789557942224484","215980018141197532225823058179319508966","326265773554585183861935897085821889792","153016311601951300163194025966712416348","41223495171425725935768598574030836236","73055855404982602899009644939483123911","163760253656994444627371509946523626745","326270767391998666243405565587410139027","21317067112051592000597913966275554256","21303371786340289907177199149339579017","141308341991969646721653105511211871544","132262255902660676784860628035833211854","293735721632118471102227424222709244977","221264892404686019464685055981909563111","167759133802468412508345170663431226633","71347009309543524355816792432221179239","211646842768553748453221982415854906769","276001425944214196365438431424341285819","338147656409631818352586151739214891137","139501971923782827912143745739544394496","240171181337349374938990791252547871683","242930214086228328340722088946664435915","222107848685985131822420968400409755515","255328590063357841548329944227279674082","170693431140236290391811455509457615590","245732717629199971414628650016255457072","276467132395211738253667612045270985305","85124173254011616343682277197062335705","44681918832048174637271171294097797337","69968641243102480559258664819451322066","90667481138473626587233160946266639843","39566122999683459511693906427339319333","210276426144199593022758294752956421328","259302997351518479913851084929512926072","202306238703002936646733319215259740941","139087214149032422592324188453540973566","40002044136940729707559874925196572573","217217837165091857575541532206139662744","12821313245206029546059968922169585456","44658668401680493299680162382123417292","175607596901502442056537374123447728862","97181439557430282520529664894348269765","233315828623965065036633752229781993288","261099815035900052209875950704887419095","270632694493350101716151865227550533329","203497697238462247273254713076229473745","9343493068014598960721107703773931128","242673109635391476084032728898276412835","18453380910163286198796130559632562435","104888557086166439678103512294016953627","243688004514957275658509081710427018459","168723782744620544193929341216401031","59290559106496669692371089690767723133","292802539465384882407807210886461318624","244509731758780223817017543870043689804","323317634518113687318935871134007697479","114125956606386089272678878162930540369","111764345639786173480476303994901028577","121801479907906847487770970108608413647","132188957617397172780873823787617111259","293793906009143494038797256037103140805","169184990437227263978955076785177916518","94225940410244212654394837812933149569","2413510635908234320874912433937532345","51823902924222067872913661736555908556","74201910514270109037751204142018922238","218447670243756189704042677206333849342","185430168333881932020418791347129837157","12676059919280136951297873410834770070","118866395794606183282639351836489315320","95024357374552156682283951689913275821","306842509565170693962536541824150445109","303721449731154084663545825922948318176","269059617568928484200214866159204285732","133551376984235634007323458932038738050","277757868479419017971588481729327477764","274337210679566480177013780423241224175","73655726370855520026813867600863207428","2963096946539824611768680187661528514","256592267437931151947706343005662993181","333155539819150157011758439108980012502","257276458968230283278613371668046977926","123804571434507087119104105204184351833","213886601929572151805119867943290062035","306670943761999211228393447656349343302","179366580121051128105058221258737089772","18991959755423307049873603128261153564","4729676050886747518381600536902444480","313379439549369443501585656237313040722","288800748840345940972284546205910281235","53116335705619146372032629245109059017","210022783070824762531757304827496582718","76438488584974241649150933072923046510","281241755285514922764693615934105848807","249094017505389788375967665083751902957","176778355680320019337700317732774449198","241878692258798361552492931547545481131","18878265566416967482422046676406654178","43704644958743538843103064386883576065","39566122999683459511693906427339319333","210276426144199593022758294752956421328","259302997351518479913851084929512926072","292479637473478100743903930361628331889","94838258634036952379285723974370152870","267540841389413277068490151213246380057","33920302981111317555319466101594661181","44658668401680493299680162382123417292","64127843609340301116692262054851468722","156077718382899318980415647170797348139","216236465366747338915625698749096860011","286734961038078602128023807645274738581","119901165339083736935350994055712591152","193260016832149281907561658429772166830","336152897550384443634703568130827826801","310286142565705374113138475950351317167","21297331385581450595302025229787340259","21263092574053071887199851976085890980","3642735647138255756149453729786444793","289726625231100758520085302340290035431","79212690355945162840747813231638670898","336478182039081948936791277578454701683","32511478099051881603292100463527563559","298109219573885584191639612000203469731","286285052313678222957291883417817496121"],"threshold":0.9},"id":"CVE-2026-84894-e1a132a1","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94","target":{"file":"moxygen/MoQSession.cpp"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94","target":{"file":"moxygen/MoQSession.cpp","function":"MoQSession::handlePreSetupUniStream"},"deprecated":false,"digest":{"length":1730,"function_hash":"129489424189411872175341228802884761629"},"id":"CVE-2026-84894-e65e8a3a"},{"deprecated":false,"digest":{"line_hashes":["259897773993977273356000530114569935244","220277384392401909691602838447329553619","2117983858845533566317022479214818859","322467583376825171888034168187623842664","12068382094400281546248437567380344842","16163085583497993706418006428449066214"],"threshold":0.9},"id":"CVE-2026-84894-ef6020c5","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94","target":{"file":"moxygen/test/MoQSessionTests.cpp"}}]}}],"schema_version":"1.9.0"}