| Package | Affected versions | Patched versions |
|---|---|---|
| proxygen | ≥ 2025.08.25.00, ≤ 2025.12.01.00 |
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free