cve.bz

facebook mvfst vulnerabilities in 2026, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. –CVE-2026-119236EPSS 0.1%

    An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO…

  2. –CVE-2026-119234EPSS 0.2%

    mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment …