CVE-2019-11921

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-25 · updated 2026-06-17
Weakness: CWE-787

Description

An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.

Affected products

Facebook proxygen: before 2019.07.22.00 — fixed in 2019.07.22.00

How to fix

Upgrade to a fixed version: Facebook proxygen 2019.07.22.00. Check the vendor advisory for mitigations.

References

https://github.com/facebook/proxygen/commit/2f07985bef9fbae124cc63e5c0272e32da4fdaec
https://www.facebook.com/security/advisories/cve-2019-11921
https://github.com/facebook/proxygen/commit/2f07985bef9fbae124cc63e5c0272e32da4fdaec
https://www.facebook.com/security/advisories/cve-2019-11921

Get alerted when CVE-2019-11921 or the next vulnerability affects your stack