CyberRota Analysis
AI-GeneratedProxygen is vulnerable due to its lack of a slow-consumer detection mechanism in the HTTP session layer, allowing remote, unauthenticated attackers to exploit HTTP/2 flow-control. By manipulating SETTINGS_INITIAL_WINDOW_SIZE or withholding WINDOW_UPDATE frames, an attacker can cause the server to indefinitely buffer response bodies, leading to unbounded memory growth and potential denial of service. Organizations using affected versions (v2017.01.16.00 through v2026.07.20.00) should prioritize patching to mitigate risks of service degradation and resource exhaustion.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected.