facebook mvfst vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. –CVE-2026-119236EPSS 0.1%2026-11-11

   An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO…

2. –CVE-2026-119234EPSS 0.2%2026-11-11

   mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment …

3. 8.1CVE-2025-30403EPSS 0.3%2025-07-11

   A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.

4. 7.5CVE-2021-24029EPSS 1.2%2021-03-15

   A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. Th…