CVE-2026-119234
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC peer could send many small, non-contiguous stream fragments to make an endpoint consume memory far in excess of its advertised receive window and spend increasing CPU time reassembling stream data, leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.0.
| Vendor | |
| Product | mvfst |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for facebook mvfst
Be the first to know when new unknown vulnerabilities affecting facebook mvfst are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Facebook / mvfst
v0.0.0.0 < v2026.11.09.0