Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-55181 EUVD-2025-200372GHSA-886p-82g3-p77g

Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which b…

Published Dec 2, 2025 · Updated Dec 3, 2025 · Assigned by Meta

Description

Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.

Affected products

VendorProductAffectedFixed
Facebook proxygen v2025.08.25.00 – ≤ v2025.12.01.00 —

References