Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
References
| Link | Resource |
|---|---|
| https://github.com/facebook/proxygen/commit/17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f | Patch |
| https://www.facebook.com/security/advisories/cve-2025-55181 | Vendor Advisory |
Configurations
History
19 Dec 2025, 18:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/facebook/proxygen/commit/17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f - Patch | |
| References | () https://www.facebook.com/security/advisories/cve-2025-55181 - Vendor Advisory | |
| First Time |
Facebook proxygen
|
|
| CPE | cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:* |
03 Dec 2025, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-834 |
02 Dec 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-02 22:16
Updated : 2025-12-19 18:02
NVD link : CVE-2025-55181
Mitre link : CVE-2025-55181
CVE.ORG link : CVE-2025-55181
JSON object : View
Products Affected
- proxygen
CWE
CWE-834
Excessive Iteration