{"id":"CVE-2026-91096","details":"In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.","modified":"2026-09-30T08:06:55.953760Z","published":"2026-09-28T21:17:19.313Z","references":[{"type":"ADVISORY","url":"https://www.facebook.com/security/advisories/cve-2026-91096"},{"type":"FIX","url":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/proxygen","events":[{"introduced":"0"},{"fixed":"57838dc9bbfd17156d482efb83a16ee71612051e"},{"fixed":"479eb5574195764e80e6cedebef669f6baa85083"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"v2025.08.18.00"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2026.09.21.00","v2026.09.14.00","v2026.09.07.00","v2026.08.31.00","v2026.08.24.00","v2026.08.17.00","v2026.08.10.00","v2026.08.03.00","v2026.07.27.00","v2026.07.20.00","v2026.07.13.00","v2026.07.06.00","v2026.06.29.00","v2026.06.22.00","v2026.06.15.00","v2026.06.08.00","v2026.06.01.00","v2026.05.25.00","v2026.05.18.00","v2026.05.11.00","v2026.05.04.00","v2026.04.27.00","v2026.04.20.00","v2026.04.13.00","v2026.04.06.00","v2026.03.30.00","v2026.03.23.00","v2026.03.16.00","v2026.03.09.00","v2026.03.02.00","v2026.02.23.00","v2026.02.16.00","v2026.02.09.00","v2026.02.02.00","v2026.01.26.00","v2026.01.19.00","v2026.01.12.00","v2026.01.05.00","v2025.12.29.00","v2025.12.22.00","v2025.12.15.00","v2025.12.02.00","v2025.12.01.00","v2025.11.24.00","v2025.11.17.00","v2025.11.10.00","v2025.11.03.00","v2025.10.27.00","v2025.10.20.00","v2025.10.13.00","v2025.10.06.00","v2025.09.29.00","v2025.09.22.00","v2025.09.15.00","v2025.09.08.00","v2025.09.01.00","v2025.08.25.00","v2025.08.18.00","v2025.08.11.00","v2025.08.04.00","v2025.07.28.00","v2025.07.21.00","v2025.07.14.00","v2025.07.07.00","v2025.06.30.00","v2025.06.23.00","v2025.06.16.00","v2025.06.09.00","v2025.06.02.00","v2025.05.26.00","v2025.05.19.00","v2025.05.12.00","v2025.05.05.00","v2025.04.28.00","v2025.04.21.00","v2025.04.14.00","v2025.04.07.00","v2025.03.31.00","v2025.03.24.00","v2025.03.17.00","v2025.03.10.00","v2025.03.03.00","v2025.02.24.00","v2025.02.17.00","v2025.02.10.00","v2025.02.03.00","v2025.01.27.00","v2025.01.20.00","v2025.01.13.00","v2025.01.06.00","v2024.12.30.00","v2024.12.23.00","v2024.12.16.00","v2024.12.09.00","v2024.12.02.00","v2024.11.25.00","v2024.11.18.00","v2024.11.11.00","v2024.11.04.00","v2024.10.28.00","v2024.10.21.00","v2024.10.14.00","v2024.10.07.00","v2024.09.30.00","v2024.09.23.00","v2024.09.16.00","v2024.09.09.00","v2024.09.02.00","v2024.08.26.00","v2024.08.19.00","v2024.08.12.00","v2024.08.05.00","v2024.07.29.00","v2024.07.22.00","v2024.07.15.00","v2024.07.08.00","v2024.07.01.00","v2024.06.24.00","v2024.06.17.00","v2024.06.10.00","v2024.06.03.00","v2024.05.27.00","v2024.05.20.00","v2024.05.13.00","v2024.05.06.00","v2024.05.02.00","v2024.04.29.00","v2024.04.22.00","v2024.04.15.00","v2024.04.08.00","v2024.04.01.00","v2024.03.25.00","v2024.03.18.00","v2024.03.11.00","v2024.03.04.00","v2024.02.26.00","v2024.02.19.00","v2024.02.12.00","v2024.02.05.00","v2024.01.29.00","v2024.01.22.00","v2024.01.15.00","v2024.01.08.00","v2024.01.01.00","v2023.12.25.00","v2023.12.18.00","v2023.12.11.00","v2023.12.04.00","v2023.11.27.00","v2023.11.20.00","v2023.11.13.00","v2023.11.06.00","v2023.10.30.00","v2023.10.23.00","v2023.10.16.00","v2023.10.09.00","v2023.10.02.00","v2023.09.25.00","v2023.09.18.00","v2023.09.11.00","v2023.09.04.00","v2023.08.28.00","v2023.08.14.00","v2023.08.07.00","v2023.07.31.00","v2023.07.24.00","v2023.07.17.00","v2023.07.10.00","v2023.07.03.00","v2023.06.26.00","v2023.06.19.00","v2023.06.12.00","v2023.06.08.00","v2023.05.22.00","v2023.05.15.00","v2023.05.08.00","v2023.05.01.00","v2023.04.24.00","v2023.04.17.00","v2023.04.10.00","v2023.04.03.00","v2023.03.27.00","v2023.03.20.00","v2023.03.13.00","v2023.03.06.00","v2023.02.27.00","v2023.02.20.00","v2023.02.13.00","v2023.02.06.00","v2023.01.30.00","v2023.01.23.00","v2023.01.16.00","v2023.01.09.00","v2023.01.02.00","v2022.12.26.00","v2022.12.19.00","v2022.12.12.00","v2022.12.05.00","v2022.11.28.00","v2022.11.14.00","v2022.11.07.00","v2022.10.31.00","v2022.10.24.00","v2022.10.17.00","v2022.10.10.00","v2022.10.03.00","v2022.09.26.00","v2022.09.19.00","v2022.09.12.00","v2022.09.05.00","v2022.08.29.00","v2022.08.22.00","v2022.08.15.00","v2022.08.08.00","v2022.08.01.00","v2022.07.25.00","v2022.07.18.00","v2022.07.11.00","v2022.07.04.00","v2022.06.27.00","v2022.06.20.00","v2022.06.13.00","v2022.06.06.00","v2022.05.30.00","v2022.05.23.00","v2022.05.16.00","v2022.05.09.00","v2022.05.02.00","v2022.04.25.00","v2022.04.18.00","v2022.04.11.00","v2022.04.04.00","v2022.03.28.00","v2022.03.21.00","v2022.03.14.00","v2022.03.07.00","v2022.02.28.00","v2022.02.21.00","v2022.02.14.00","v2022.02.07.00","v2022.01.31.00","v2022.01.24.00","v2022.01.17.00","v2022.01.10.00","v2022.01.03.00","v2021.12.27.00","v2021.12.20.00","v2021.12.13.00","v2021.12.06.00","v2021.11.29.00","v2021.11.15.00","v2021.11.08.00","v2021.11.01.00","v2021.10.25.00","v2021.10.18.00","v2021.10.11.00","v2021.10.04.00","v2021.09.27.00","v2021.09.20.00","v2021.09.13.00","v2021.09.06.00","v2021.08.30.00","v2021.08.23.00","v2021.08.02.00","v2021.07.22.00","v2021.07.20.00","v2021.07.19.00","v2021.07.12.00","v2021.07.05.00","v2021.06.28.00","v2021.06.21.00","v2021.06.14.00","v2021.06.07.00","v2021.05.31.00","v2021.05.24.00","v2021.05.17.00","v2021.05.10.00","v2021.05.03.00","v2021.04.26.00","v2021.04.19.00","v2021.04.12.00","v2021.04.05.00","v2021.03.29.00","v2021.03.22.00","v2021.03.15.00","v2021.03.01.00","v2021.02.22.00","v2021.02.15.00","v2021.02.08.00","v2021.02.01.00","v2021.01.25.00","v2021.01.18.00","v2021.01.11.00","v2021.01.04.00","v2020.12.28.00","v2020.12.21.00","v2020.12.14.00","v2020.12.07.00","v2020.11.30.00","v2020.11.23.00","v2020.11.16.00","v2020.11.09.00","v2020.11.02.00","v2020.10.26.00","v2020.10.19.00","v2020.10.12.00","v2020.10.05.00","v2020.09.28.00","v2020.09.21.00","v2020.09.14.00","v2020.09.07.00","v2020.08.31.00","v2020.08.24.00","v2020.08.17.00","v2020.08.10.00","v2020.08.03.00","v2020.07.27.00","v2020.07.20.00","v2020.07.13.00","v2020.07.06.00","v2020.06.29.00","v2020.06.15.00","v2020.06.08.00","v2020.06.01.00","v2020.05.25.00","v2020.05.18.00","v2020.05.11.00","v2020.05.04.00","v2020.04.27.00","v2020.04.20.00","v2020.04.13.00","v2020.04.06.00","v2020.03.30.00","v2020.03.23.00","v2020.03.16.00","v2020.03.09.00","v2020.03.02.00","v2020.02.24.00","v2020.02.17.00","v2020.02.10.00","v2020.02.03.00","v2020.01.27.00","v2020.01.20.00","v2020.01.13.00","v2020.01.06.00","v2019.12.30.00","v2019.12.23.00","v2019.12.16.00","v2019.12.09.00","v2019.12.06.00","v2019.12.02.00","v2019.11.11.00","v2019.11.04.00","v2019.10.28.00","v2019.10.21.00","v2019.10.14.00","v2019.10.07.00","v2019.09.30.00","v2019.09.23.00","v2019.09.16.00","v2019.09.09.00","v2019.09.02.00","v2019.08.26.00","v2019.08.19.00","v2019.08.12.00","v2019.08.05.00","v2019.07.29.00","v2019.07.22.00","v2019.07.15.00","v2019.07.08.00","v2019.07.01.00","v2019.06.24.00","v2019.06.17.00","v2019.06.10.00","v2019.06.03.00","v2019.05.27.00","v2019.05.20.00","v2019.05.13.00","v2019.05.06.00","v2019.04.29.00","v2019.04.22.00","v2019.04.15.00","v2019.04.08.00","v2019.04.01.00","v2019.03.25.00","v2019.03.18.00","v2019.03.04.00","v2019.02.25.00","v2019.02.18.00","v2019.02.11.00","v2019.02.04.00","v2019.01.28.00","v2019.01.21.00","v2019.01.14.00","v2019.01.07.00","v2018.12.31.00","v2018.12.24.00","v2018.12.17.00","v2018.12.10.00","v2018.12.03.00","v2018.11.26.00","v2018.11.19.00","v2018.11.12.00","v2018.11.05.00","v2018.10.29.00","v2018.10.22.00","v2018.10.15.00","v2018.10.08.00","v2018.10.01.00","v2018.09.24.00","v2018.09.17.00","v2018.09.10.00","v2018.09.03.00","v2018.08.27.00","v2018.08.20.00","v2018.08.13.00","v2018.08.06.00","v2018.07.30.00","v2018.07.23.00","v2018.07.16.00","v2018.07.09.00","v2018.07.02.00","v2018.06.25.00","v2018.06.18.00","v2018.06.11.00","v2018.06.04.00","v2018.05.28.00","v2018.05.21.00","v2018.05.14.00","v2018.05.07.00","v2018.04.30.00","v2018.04.23.00","v2018.04.16.00","v2018.04.09.00","v2018.04.02.00","v2018.03.26.00","v2018.03.19.00","v2018.03.12.00","v2018.03.05.00","v2018.02.26.00","v2018.02.19.00","v2018.02.12.00","v2018.02.05.00","v2018.01.29.00","v2018.01.22.00","v2018.01.15.00","v2018.01.08.00","v2018.01.01.00","v2017.12.25.00","v2017.12.18.00","v2017.12.11.00","v2017.12.04.00","v2017.11.27.00","v2017.11.20.00","v2017.11.13.00","v2017.11.06.00","v2017.10.30.00","v2017.10.23.00","v2017.10.16.00","v2017.10.09.00","v2017.10.02.00","v2017.09.25.00","v2017.09.18.00","v2017.09.11.00","v2017.09.04.00","v2017.08.28.00","v2017.08.21.00","v2017.08.14.00","v2017.08.07.00","v2017.07.31.00","v2017.07.24.00","v2017.07.17.00","v2017.07.10.00","v2017.07.03.00","v2017.06.26.00","v2017.06.19.00","v2017.06.12.00","v2017.06.05.00","v2017.05.29.00","v2017.05.22.00","v2017.05.15.00","v2017.05.08.00","v2017.05.01.00","v2017.04.24.00","v2017.04.17.00","v2017.04.10.00","v2017.04.03.00","v2017.03.27.00","v2017.03.20.00","v2017.03.13.00","v2017.03.06.00","v2017.01.30.00","v2017.01.23.00","v2017.01.16.00","v0.32.0","v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91096.json","vanir_signatures_modified":"2026-09-30T08:06:55Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/session/HQSession.cpp","function":"HQSession::HQStreamTransport::stopReadingWebTransportIngress"},"deprecated":false,"digest":{"function_hash":"138360123063664317705044831249555463531","length":523},"id":"CVE-2026-91096-161d742b","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"21621139288411092512948520514044133575","length":193},"id":"CVE-2026-91096-19ddbf33","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/webtransport/WebTransportImpl.cpp","function":"WebTransportImpl::stopReadingWebTransportIngress"}},{"digest":{"function_hash":"148418963197441794752073552350908873919","length":583},"id":"CVE-2026-91096-3d6ca186","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"function":"HTTPTransaction::onWebTransportBidiStream","file":"proxygen/lib/http/session/HTTPTransaction.cpp"},"deprecated":false},{"id":"CVE-2026-91096-4f04b9df","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/webtransport/WebTransportImpl.h"},"deprecated":false,"digest":{"line_hashes":["161523711137787904343579444145195034474","205474114267531418407046613774285149691","26789001215329089002861194982760007382","238176949922881251912722882810329436708","250724414223687184035819931148027227934","50811890631373295464553789758032334432","335825338229293376719055173325759371126","288031401053181561234404589812571927558","153169946939996725759952130581994831139","189559874761578300530794018464888731801"],"threshold":0.9}},{"digest":{"function_hash":"315007737331498138808327810059957878390","length":376},"id":"CVE-2026-91096-5abd4ba3","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/session/HTTPTransaction.cpp","function":"HTTPTransaction::onWebTransportUniStream"},"deprecated":false},{"digest":{"function_hash":"96001740010457926752761310920964549747","length":1509},"id":"CVE-2026-91096-5bc4a928","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/webtransport/WebTransportImpl.cpp","function":"WebTransportImpl::StreamReadHandle::readStreamData"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["145861966540313923077556585691730986955","136074389731266346004058456481998139853","155498450981073337245729102785402335950"],"threshold":0.9},"id":"CVE-2026-91096-6554cd8c","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/session/test/HQDownstreamSessionTest.cpp"}},{"deprecated":false,"digest":{"function_hash":"331749133635833061207483516943482375965","length":854},"id":"CVE-2026-91096-7de20017","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"function":"HTTPBinaryCodec::onIngressEOF","file":"proxygen/lib/http/codec/HTTPBinaryCodec.cpp"}},{"source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/codec/test/HTTPBinaryCodecTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"32912772477336829924091588403234526980","length":1567},"id":"CVE-2026-91096-7ded13a8","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["187629045774371785970335036298085772759","235992591681084297418839398808757002350","244596825151869311161614308010726746541","225471898341769669228196368538810102604","148001532627403463689725855116298786095"],"threshold":0.9},"id":"CVE-2026-91096-7f281a35","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/session/test/HTTPTransactionWebTransportTest.cpp"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/codec/test/HTTPBinaryCodecTest.cpp"},"deprecated":false,"digest":{"line_hashes":["198588761747353280577210119262493986369","287619295498267682603114540902823641432","273515210669057555610222001104097289783","170965080193446236866679796902379650545","227002004891221114505322732676416547552","249547429439204127114734829503424671048","90829697753508615150294958528033364598","280297037902785440476728202059257853970","56332611574532847384424834577444707049","53775454293491746559508685878635775106","92680149783186707536654268128325449814","130625231777626024984609938149361786757","218116226973505798294174729410315413158","74946665258245815869525933107927553854","233885721783719363171211575312746934305","248146184630959448682506588632487988936","2007133905042070295497887770888225947","308478698069779397249817773161094345521","260908434002106757859982718809126304400","178739337037696576153486037911669057983","251898469951712675295042233943040483361","123050193975104041898066339048126582141","337800351894538811354456688996280628008","227608220456227191643674578766931293991","9998647003565824380061891290841632301","309980392440695610762302696906987671088","302265871672795071260406768182361010417","63338511660062892466626106134585461814","78567228824380859699802474734753953232","295820141081969884781350203859080052536","156370434458544128293870014883250682374","305389336451726275032224680798171018138","316097928521469009789072861102745556522","123997707233028498703523024034933907809","128697365277188360871734057477821511511"],"threshold":0.9},"id":"CVE-2026-91096-832b290d"},{"id":"CVE-2026-91096-9b57e8fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/webtransport/WebTransportImpl.cpp","function":"WebTransportImpl::terminateSessionStreams"},"deprecated":false,"digest":{"function_hash":"46050150011650082201885137354165849678","length":581}},{"source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/session/HQSession.cpp","function":"HQSession::deliverWTStream"},"deprecated":false,"digest":{"function_hash":"189383824846132347639841209449055202390","length":542},"id":"CVE-2026-91096-9ed58b9f","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"215627226419630136009871299795471294744","length":1502},"id":"CVE-2026-91096-aa8220f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/session/test/HTTPTransactionWebTransportTest.cpp","function":"TEST_F"}},{"id":"CVE-2026-91096-b44ec878","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/codec/HTTPBinaryCodec.cpp","function":"HTTPBinaryCodec::parseSingleHeaderHelper"},"deprecated":false,"digest":{"function_hash":"98085346050739968651843367189070773472","length":1065}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/session/HTTPTransaction.cpp"},"deprecated":false,"digest":{"line_hashes":["51260867160464289970018837867978420453","296732215517578265004150613535020400094","259850419858382852086213735415389585528","174020160013018801152592946712577082741","293348073276470877290288160588781275266","213079880044365832940691632302752115673","38289846949371947904097303663861354315","240003882947427586718525293913244062398","167752838730762168705812275673979418997","248305204380683032150790823179092163126","196677913965043003433017333820025128829","306765825440982933810932930054210198174","109286659046918832018707472159105696946","191854202393079040346399443891608305347","8953023373976796538123480898488859067","339774319927855888550252678067727710694","262003970451043329541045678753265389279"],"threshold":0.9},"id":"CVE-2026-91096-b80404c9"},{"source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/codec/HTTPBinaryCodec.cpp","function":"HTTPBinaryCodec::parseKnownLengthHeadersHelper"},"deprecated":false,"digest":{"function_hash":"66652873698882478867363952741985214526","length":1071},"id":"CVE-2026-91096-c205c00c","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"120716554370594194714095577854795894574","length":773},"id":"CVE-2026-91096-d1f0762f","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"function":"TEST_F","file":"proxygen/lib/http/codec/test/HTTPBinaryCodecTest.cpp"},"deprecated":false},{"target":{"file":"proxygen/lib/http/codec/HTTPBinaryCodec.cpp","function":"HTTPBinaryCodec::parseIndeterminateLengthHeadersHelper"},"deprecated":false,"digest":{"function_hash":"61175608856746199469907870208243130006","length":979},"id":"CVE-2026-91096-d36179ee","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083"},{"signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/codec/test/HTTPBinaryCodecTest.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"143271683207194779193896082027242771952","length":2186},"id":"CVE-2026-91096-e650d103","signature_type":"Function"},{"source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/session/HQSession.cpp"},"deprecated":false,"digest":{"line_hashes":["314870076066756790480238215501967856089","196906496449945267946841204072156051166","5934697323121432226963149248939020198","119762308929219233563459374894842023064","59385509429970112302183107699361717440","263186850078004563602628979963971116193","311150334828024886208079118118657904358","9855676066652703770592765571886967033","8604333367526276201646784369970082266","281375968432018702303116441449990503721","211700959628837076573913573609867922259","50033286686377535444160484799826280563","269431742105966120093116308406201300237","37191515900254218544701813215908192915","174933785823935401808058909413992091193","47045438881583103884697066740963267263","116289058542489871814870772190452197164","119081684893706823574469255523320301596","144818394407159821278851507451077332624"],"threshold":0.9},"id":"CVE-2026-91096-e9472108","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91096-ec3dfe5c","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/codec/HTTPBinaryCodec.cpp"},"deprecated":false,"digest":{"line_hashes":["83245271756198010134741001823942610990","299669869304276703338440383649054372573","226582523696706609996562958601196516","281557968970722656062437551959807381007","199513496538458816810802582886512500845","238876599428321897179539324591097401614","115748378406312463196902625358695910063","94033375552324928903470076570831912219","243260750938455949458939422054330517231","29707469399295268960196166389302912782","305718501069518756709455730350954958910","109410887196358393440897692053077258174","165144474503689356406556881023927473878","95037916448484320522635014797161341937","265869371132829933193215819436732561359","144880702791867449029342333074563777905","76336025403513631187950607999242005686","310339125962432334920349889563007483663","52803539332189276749410642782143201503","153799147879729027298361764770614540156","159080432430864559451850344221604147236","320403108991802458655286320192533041709","288432346420496630293676977034514218368","79876962555014789457126971110242759917","253944608635896563282375595357974631311","302564848089356098514076390233834451814","283487834770972316989190370028909432862","264264234873436168286404322222434660697","45112741605424686592674323051785253552","303081883564621431500350078136116198917","108408069611167837081955414103110905720","324696532373540080626276145306297556920","297304809923547449873585740319568271291","104954415314117193950453145593029720551","65880837761704270731461423848645431808","124174558209123355897276395554923748311","126897464108676922302258246998208346057","59915361624729266320177592579998154889","215976014756197565731680461262114047883","277237052180412549221312802034926645985","99032022135399322117322111889436203394","69089115454770749497236017464331303489","16636630895039558866248437509109290029","164060320022479706035523193311588754300","113879765881165852139914186845960650612","297304809923547449873585740319568271291","152295484194584322473856300045401420256","91991039552569764812167405112671452832","226277509508932958241714411647859108785","273930241697271523863683736324054807015","121777001640370697799368937472609658937","73294418974141893014245286393669453956","180618518071059241881980197282746903093","117005836857959356817116774869008128069","22982055759860080464907168680531541838","318658949538662481234825113935549890649","103344132170392711120178744710241994506","26928593228105281475231901400549899071","178613283415951262320023357231845447979","316831456150515652736374052506484012122","4751992420457423879360300505204544031","165994204635720418494377142954268772754","334271704830525570092909166400591635323","15418856847596032898933758351731912422","149354152215625161439360975253319311575","254790119174337049041536028991041650331"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["198791346169858981760051286844265837840","10618709560399588958624880069708337995","327503127466038172309656907618937737003","69391518485499617172259013806817967977"],"threshold":0.9},"id":"CVE-2026-91096-edd1ecc6","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/codec/HTTPBinaryCodec.h"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["318052132457781640979913556930012185650","83152031357150843091651076777282063938","214538714547114560447164344935041512108","60487055733731142501725378488306360534","82394485833878665106173188306941294171","170981450380513231728977972824399814762","329187022535073464345423760023084307574","301359881130799083610048326964802093149","144093622686669802483341790375341517229","138678768339663197215198891311144953617","115402135902211922541220153708938209002","127976195365999170477452852766946404198","33785489405449112044603055862857658709","326547988490764536006021771675750664152","298391830917019990997138209257878240316","256678923333674571940019897387316265854","291609617207747735530723362218837367902","54743421487913933725999769063508448483","182335656734203625258404272381538853851","16246722329777042441286867735536111185","333646990514192870592407655481741215644","175866923493703334701276856361018499154","290462143393795448302385270925897062861","92384186428506932804727176941938266427","186413320829794478795742937750133761526","197945429890246287184935173745537246043","114892258021372890465648230794437997983","304755951958968378137358028028808033405"]},"id":"CVE-2026-91096-ff3d051c","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083","target":{"file":"proxygen/lib/http/webtransport/WebTransportImpl.cpp"}}]}}],"schema_version":"1.9.0"}