CVE-2026-121737 Use after free in proxygen
Unauthenticated clients can crash proxygen by pipelining HTTP requests, possibly causing memory corruption; proxygen operators should care.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-121737?
CVE-2026-121737 is an use after free vulnerability in Facebook proxygen, published on 11 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based HTTP session could free that pipelined stream while resetting the connection's streams on the resulting write timeout, then go on to use it. This can crash the server, leading to denial of service, and may allow memory corruption with further impact. This issue affects proxygen versions prior to v2026.11.09.00.
Which versions are affected by CVE-2026-121737?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-121737?
No fix has been published for CVE-2026-121737 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-121737 being exploited?
There is no known exploitation of CVE-2026-121737 in the wild and no public exploit code.
Sources
Also known as GHSA-6f4m-hgmg-4rx8.