CVE-2025-55181
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55181?
CVE-2025-55181 is considered a medium severity vulnerability due to potential unbounded memory growth.
How do I fix CVE-2025-55181?
To fix CVE-2025-55181, upgrade to a version of Facebook Proxygen released after 2025.12.01.00.
What impact does CVE-2025-55181 have on applications?
CVE-2025-55181 can cause an infinite loop that blocks the event loop, leading to degraded performance or application crashes.
Which versions of Facebook Proxygen are affected by CVE-2025-55181?
CVE-2025-55181 affects Facebook Proxygen versions between 2025.08.25.00 and 2025.12.01.00.
Does CVE-2025-55181 affect specific platforms?
CVE-2025-55181 primarily affects applications utilizing Facebook Proxygen for handling HTTP requests.