The vulnerability arises because Proxygen’s core HTTP session layer does not detect a slow‑consuming client. A remote, unauthenticated attacker can set the HTTP/2 SETTINGS_INITIAL_WINDOW_SIZE to zero or withhold WINDOW_UPDATE frames, forcing the server to buffer complete response bodies in memory. When many such streams are opened simultaneously to large resources, the memory usage grows without bound, leading to resource exhaustion, service degradation, or denial of service. The flaw is classified as uncontrolled resource consumption.

Facebook’s Proxygen library, versions v2017.01.16.00 through v2026.07.20.00, is affected. Any application or server that incorporates one of these releases and handles HTTP/2 traffic is at risk.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests a relatively low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote network access via HTTP/2, requiring only the ability to send crafted requests. An attacker can open many concurrent streams requesting large resources while preventing the server from transmitting responses, causing unbounded memory growth. No authentication or special privileges are needed, and the vulnerability can be leveraged to degrade or deny service if the host lacks countermeasures such as flow‑control validation, stream limits, or memory quotas.