High
Security advisory
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-84895
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:14 UTC · Revision 1
Source evidence
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.
osv:CVE-2026-84895
Complete source record
{
"id": "ef336f91c412e9f39911d1354a81e2229ce32edfaf5186302b494b940881cfe7",
"url": "https://osv.dev/vulnerability/CVE-2026-84895",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-84895",
"summary": "In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.",
"evidence": "osv:CVE-2026-84895",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-84895",
"aliases": [
"CVE-2026-84895"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebook/proxygen",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "479eb5574195764e80e6cedebef669f6baa85083"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "479eb5574195764e80e6cedebef669f6baa85083"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2026.09.21.00",
"v2026.09.14.00",
"v2026.09.07.00",
"v2026.08.31.00",
"v2026.08.24.00",
"v2026.08.17.00",
"v2026.08.10.00",
"v2026.08.03.00",
"v2026.07.27.00",
"v2026.07.20.00",
"v2026.07.13.00",
"v2026.07.06.00",
"v2026.06.29.00",
"v2026.06.22.00",
"v2026.06.15.00",
"v2026.06.08.00",
"v2026.06.01.00",
"v2026.05.25.00",
"v2026.05.18.00",
"v2026.05.11.00",
"v2026.05.04.00",
"v2026.04.27.00",
"v2026.04.20.00",
"v2026.04.13.00",
"v2026.04.06.00",
"v2026.03.30.00",
"v2026.03.23.00",
"v2026.03.16.00",
"v2026.03.09.00",
"v2026.03.02.00",
"v2026.02.23.00",
"v2026.02.16.00",
"v2026.02.09.00",
"v2026.02.02.00",
"v2026.01.26.00",
"v2026.01.19.00",
"v2026.01.12.00",
"v2026.01.05.00",
"v2025.12.29.00",
"v2025.12.22.00",
"v2025.12.15.00",
"v2025.12.02.00",
"v2025.12.01.00",
"v2025.11.24.00",
"v2025.11.17.00",
"v2025.11.10.00",
"v2025.11.03.00",
"v2025.10.27.00",
"v2025.10.20.00",
"v2025.10.13.00",
"v2025.10.06.00",
"v2025.09.29.00",
"v2025.09.22.00",
"v2025.09.15.00",
"v2025.09.08.00",
"v2025.09.01.00",
"v2025.08.25.00",
"v2025.08.18.00",
"v2025.08.11.00",
"v2025.08.04.00",
"v2025.07.28.00",
"v2025.07.21.00",
"v2025.07.14.00",
"v2025.07.07.00",
"v2025.06.30.00",
"v2025.06.23.00",
"v2025.06.16.00",
"v2025.06.09.00",
"v2025.06.02.00",
"v2025.05.26.00",
"v2025.05.19.00",
"v2025.05.12.00",
"v2025.05.05.00",
"v2025.04.28.00",
"v2025.04.21.00",
"v2025.04.14.00",
"v2025.04.07.00",
"v2025.03.31.00",
"v2025.03.24.00",
"v2025.03.17.00",
"v2025.03.10.00",
"v2025.03.03.00",
"v2025.02.24.00",
"v2025.02.17.00",
"v2025.02.10.00",
"v2025.02.03.00",
"v2025.01.27.00",
"v2025.01.20.00",
"v2025.01.13.00",
"v2025.01.06.00",
"v2024.12.30.00",
"v2024.12.23.00",
"v2024.12.16.00",
"v2024.12.09.00",
"v2024.12.02.00",
"v2024.11.25.00",
"v2024.11.18.00",
"v2024.11.11.00",
"v2024.11.04.00",
"v2024.10.28.00",
"v2024.10.21.00",
"v2024.10.14.00",
"v2024.10.07.00",
"v2024.09.30.00",
"v2024.09.23.00",
"v2024.09.16.00",
"v2024.09.09.00",
"v2024.09.02.00",
"v2024.08.26.00",
"v2024.08.19.00",
"v2024.08.12.00",
"v2024.08.05.00",
"v2024.07.29.00",
"v2024.07.22.00",
"v2024.07.15.00",
"v2024.07.08.00",
"v2024.07.01.00",
"v2024.06.24.00",
"v2024.06.17.00",
"v2024.06.10.00",
"v2024.06.03.00",
"v2024.05.27.00",
"v2024.05.20.00",
"v2024.05.13.00",
"v2024.05.06.00",
"v2024.05.02.00",
"v2024.04.29.00",
"v2024.04.22.00",
"v2024.04.15.00",
"v2024.04.08.00",
"v2024.04.01.00",
"v2024.03.25.00",
"v2024.03.18.00",
"v2024.03.11.00",
"v2024.03.04.00",
"v2024.02.26.00",
"v2024.02.19.00",
"v2024.02.12.00",
"v2024.02.05.00",
"v2024.01.29.00",
"v2024.01.22.00",
"v2024.01.15.00",
"v2024.01.08.00",
"v2024.01.01.00",
"v2023.12.25.00",
"v2023.12.18.00",
"v2023.12.11.00",
"v2023.12.04.00",
"v2023.11.27.00",
"v2023.11.20.00",
"v2023.11.13.00",
"v2023.11.06.00",
"v2023.10.30.00",
"v2023.10.23.00",
"v2023.10.16.00",
"v2023.10.09.00",
"v2023.10.02.00",
"v2023.09.25.00",
"v2023.09.18.00",
"v2023.09.11.00",
"v2023.09.04.00",
"v2023.08.28.00",
"v2023.08.14.00",
"v2023.08.07.00",
"v2023.07.31.00",
"v2023.07.24.00",
"v2023.07.17.00",
"v2023.07.10.00",
"v2023.07.03.00",
"v2023.06.26.00",
"v2023.06.19.00",
"v2023.06.12.00",
"v2023.06.08.00",
"v2023.05.22.00",
"v2023.05.15.00",
"v2023.05.08.00",
"v2023.05.01.00",
"v2023.04.24.00",
"v2023.04.17.00",
"v2023.04.10.00",
"v2023.04.03.00",
"v2023.03.27.00",
"v2023.03.20.00",
"v2023.03.13.00",
"v2023.03.06.00",
"v2023.02.27.00",
"v2023.02.20.00",
"v2023.02.13.00",
"v2023.02.06.00",
"v2023.01.30.00",
"v2023.01.23.00",
"v2023.01.16.00",
"v2023.01.09.00",
"v2023.01.02.00",
"v2022.12.26.00",
"v2022.12.19.00",
"v2022.12.12.00",
"v2022.12.05.00",
"v2022.11.28.00",
"v2022.11.14.00",
"v2022.11.07.00",
"v2022.10.31.00",
"v2022.10.24.00",
"v2022.10.17.00",
"v2022.10.10.00",
"v2022.10.03.00",
"v2022.09.26.00",
"v2022.09.19.00",
"v2022.09.12.00",
"v2022.09.05.00",
"v2022.08.29.00",
"v2022.08.22.00",
"v2022.08.15.00",
"v2022.08.08.00",
"v2022.08.01.00",
"v2022.07.25.00",
"v2022.07.18.00",
"v2022.07.11.00",
"v2022.07.04.00",
"v2022.06.27.00",
"v2022.06.20.00",
"v2022.06.13.00",
"v2022.06.06.00",
"v2022.05.30.00",
"v2022.05.23.00",
"v2022.05.16.00",
"v2022.05.09.00",
"v2022.05.02.00",
"v2022.04.25.00",
"v2022.04.18.00",
"v2022.04.11.00",
"v2022.04.04.00",
"v2022.03.28.00",
"v2022.03.21.00",
"v2022.03.14.00",
"v2022.03.07.00",
"v2022.02.28.00",
"v2022.02.21.00",
"v2022.02.14.00",
"v2022.02.07.00",
"v2022.01.31.00",
"v2022.01.24.00",
"v2022.01.17.00",
"v2022.01.10.00",
"v2022.01.03.00",
"v2021.12.27.00",
"v2021.12.20.00",
"v2021.12.13.00",
"v2021.12.06.00",
"v2021.11.29.00",
"v2021.11.15.00",
"v2021.11.08.00",
"v2021.11.01.00",
"v2021.10.25.00",
"v2021.10.18.00",
"v2021.10.11.00",
"v2021.10.04.00",
"v2021.09.27.00",
"v2021.09.20.00",
"v2021.09.13.00",
"v2021.09.06.00",
"v2021.08.30.00",
"v2021.08.23.00",
"v2021.08.02.00",
"v2021.07.22.00",
"v2021.07.20.00",
"v2021.07.19.00",
"v2021.07.12.00",
"v2021.07.05.00",
"v2021.06.28.00",
"v2021.06.21.00",
"v2021.06.14.00",
"v2021.06.07.00",
"v2021.05.31.00",
"v2021.05.24.00",
"v2021.05.17.00",
"v2021.05.10.00",
"v2021.05.03.00",
"v2021.04.26.00",
"v2021.04.19.00",
"v2021.04.12.00",
"v2021.04.05.00",
"v2021.03.29.00",
"v2021.03.22.00",
"v2021.03.15.00",
"v2021.03.01.00",
"v2021.02.22.00",
"v2021.02.15.00",
"v2021.02.08.00",
"v2021.02.01.00",
"v2021.01.25.00",
"v2021.01.18.00",
"v2021.01.11.00",
"v2021.01.04.00",
"v2020.12.28.00",
"v2020.12.21.00",
"v2020.12.14.00",
"v2020.12.07.00",
"v2020.11.30.00",
"v2020.11.23.00",
"v2020.11.16.00",
"v2020.11.09.00",
"v2020.11.02.00",
"v2020.10.26.00",
"v2020.10.19.00",
"v2020.10.12.00",
"v2020.10.05.00",
"v2020.09.28.00",
"v2020.09.21.00",
"v2020.09.14.00",
"v2020.09.07.00",
"v2020.08.31.00",
"v2020.08.24.00",
"v2020.08.17.00",
"v2020.08.10.00",
"v2020.08.03.00",
"v2020.07.27.00",
"v2020.07.20.00",
"v2020.07.13.00",
"v2020.07.06.00",
"v2020.06.29.00",
"v2020.06.15.00",
"v2020.06.08.00",
"v2020.06.01.00",
"v2020.05.25.00",
"v2020.05.18.00",
"v2020.05.11.00",
"v2020.05.04.00",
"v2020.04.27.00",
"v2020.04.20.00",
"v2020.04.13.00",
"v2020.04.06.00",
"v2020.03.30.00",
"v2020.03.23.00",
"v2020.03.16.00",
"v2020.03.09.00",
"v2020.03.02.00",
"v2020.02.24.00",
"v2020.02.17.00",
"v2020.02.10.00",
"v2020.02.03.00",
"v2020.01.27.00",
"v2020.01.20.00",
"v2020.01.13.00",
"v2020.01.06.00",
"v2019.12.30.00",
"v2019.12.23.00",
"v2019.12.16.00",
"v2019.12.09.00",
"v2019.12.06.00",
"v2019.12.02.00",
"v2019.11.11.00",
"v2019.11.04.00",
"v2019.10.28.00",
"v2019.10.21.00",
"v2019.10.14.00",
"v2019.10.07.00",
"v2019.09.30.00",
"v2019.09.23.00",
"v2019.09.16.00",
"v2019.09.09.00",
"v2019.09.02.00",
"v2019.08.26.00",
"v2019.08.19.00",
"v2019.08.12.00",
"v2019.08.05.00",
"v2019.07.29.00",
"v2019.07.22.00",
"v2019.07.15.00",
"v2019.07.08.00",
"v2019.07.01.00",
"v2019.06.24.00",
"v2019.06.17.00",
"v2019.06.10.00",
"v2019.06.03.00",
"v2019.05.27.00",
"v2019.05.20.00",
"v2019.05.13.00",
"v2019.05.06.00",
"v2019.04.29.00",
"v2019.04.22.00",
"v2019.04.15.00",
"v2019.04.08.00",
"v2019.04.01.00",
"v2019.03.25.00",
"v2019.03.18.00",
"v2019.03.04.00",
"v2019.02.25.00",
"v2019.02.18.00",
"v2019.02.11.00",
"v2019.02.04.00",
"v2019.01.28.00",
"v2019.01.21.00",
"v2019.01.14.00",
"v2019.01.07.00",
"v2018.12.31.00",
"v2018.12.24.00",
"v2018.12.17.00",
"v2018.12.10.00",
"v2018.12.03.00",
"v2018.11.26.00",
"v2018.11.19.00",
"v2018.11.12.00",
"v2018.11.05.00",
"v2018.10.29.00",
"v2018.10.22.00",
"v2018.10.15.00",
"v2018.10.08.00",
"v2018.10.01.00",
"v2018.09.24.00",
"v2018.09.17.00",
"v2018.09.10.00",
"v2018.09.03.00",
"v2018.08.27.00",
"v2018.08.20.00",
"v2018.08.13.00",
"v2018.08.06.00",
"v2018.07.30.00",
"v2018.07.23.00",
"v2018.07.16.00",
"v2018.07.09.00",
"v2018.07.02.00",
"v2018.06.25.00",
"v2018.06.18.00",
"v2018.06.11.00",
"v2018.06.04.00",
"v2018.05.28.00",
"v2018.05.21.00",
"v2018.05.14.00",
"v2018.05.07.00",
"v2018.04.30.00",
"v2018.04.23.00",
"v2018.04.16.00",
"v2018.04.09.00",
"v2018.04.02.00",
"v2018.03.26.00",
"v2018.03.19.00",
"v2018.03.12.00",
"v2018.03.05.00",
"v2018.02.26.00",
"v2018.02.19.00",
"v2018.02.12.00",
"v2018.02.05.00",
"v2018.01.29.00",
"v2018.01.22.00",
"v2018.01.15.00",
"v2018.01.08.00",
"v2018.01.01.00",
"v2017.12.25.00",
"v2017.12.18.00",
"v2017.12.11.00",
"v2017.12.04.00",
"v2017.11.27.00",
"v2017.11.20.00",
"v2017.11.13.00",
"v2017.11.06.00",
"v2017.10.30.00",
"v2017.10.23.00",
"v2017.10.16.00",
"v2017.10.09.00",
"v2017.10.02.00",
"v2017.09.25.00",
"v2017.09.18.00",
"v2017.09.11.00",
"v2017.09.04.00",
"v2017.08.28.00",
"v2017.08.21.00",
"v2017.08.14.00",
"v2017.08.07.00",
"v2017.07.31.00",
"v2017.07.24.00",
"v2017.07.17.00",
"v2017.07.10.00",
"v2017.07.03.00",
"v2017.06.26.00",
"v2017.06.19.00",
"v2017.06.12.00",
"v2017.06.05.00",
"v2017.05.29.00",
"v2017.05.22.00",
"v2017.05.15.00",
"v2017.05.08.00",
"v2017.05.01.00",
"v2017.04.24.00",
"v2017.04.17.00",
"v2017.04.10.00",
"v2017.04.03.00",
"v2017.03.27.00",
"v2017.03.20.00",
"v2017.03.13.00",
"v2017.03.06.00",
"v2017.01.30.00",
"v2017.01.23.00",
"v2017.01.16.00",
"v0.32.0",
"v0.30.0",
"v0.29.0",
"v0.28.0",
"v0.27.0",
"v0.26.0",
"v0.25.0",
"v0.24.0",
"v0.23.0",
"v0.22.0",
"v0.21.0",
"v0.20.0",
"v0.19.0",
"v0.18.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84895.json",
"vanir_signatures": [
{
"id": "CVE-2026-84895-161d742b",
"digest": {
"length": 523,
"function_hash": "138360123063664317705044831249555463531"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp",
"function": "HQSession::HQStreamTransport::stopReadingWebTransportIngress"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-19ddbf33",
"digest": {
"length": 193,
"function_hash": "21621139288411092512948520514044133575"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/webtransport/WebTransportImpl.cpp",
"function": "WebTransportImpl::stopReadingWebTransportIngress"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-3d6ca186",
"digest": {
"length": 583,
"function_hash": "148418963197441794752073552350908873919"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/HTTPTransaction.cpp",
"function": "HTTPTransaction::onWebTransportBidiStream"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-4f04b9df",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161523711137787904343579444145195034474",
"205474114267531418407046613774285149691",
"26789001215329089002861194982760007382",
"238176949922881251912722882810329436708",
"250724414223687184035819931148027227934",
"50811890631373295464553789758032334432",
"335825338229293376719055173325759371126",
"288031401053181561234404589812571927558",
"153169946939996725759952130581994831139",
"189559874761578300530794018464888731801"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/webtransport/WebTransportImpl.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-5abd4ba3",
"digest": {
"length": 376,
"function_hash": "315007737331498138808327810059957878390"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/HTTPTransaction.cpp",
"function": "HTTPTransaction::onWebTransportUniStream"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-5bc4a928",
"digest": {
"length": 1509,
"function_hash": "96001740010457926752761310920964549747"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/webtransport/WebTransportImpl.cpp",
"function": "WebTransportImpl::StreamReadHandle::readStreamData"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-6554cd8c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"145861966540313923077556585691730986955",
"136074389731266346004058456481998139853",
"155498450981073337245729102785402335950"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/test/HQDownstreamSessionTest.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-7de20017",
"digest": {
"length": 854,
"function_hash": "331749133635833061207483516943482375965"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/HTTPBinaryCodec.cpp",
"function": "HTTPBinaryCodec::onIngressEOF"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-7ded13a8",
"digest": {
"length": 1567,
"function_hash": "32912772477336829924091588403234526980"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/test/HTTPBinaryCodecTest.cpp",
"function": "TEST_F"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-7f281a35",
"digest": {
"threshold": 0.9,
"line_hashes": [
"187629045774371785970335036298085772759",
"235992591681084297418839398808757002350",
"244596825151869311161614308010726746541",
"225471898341769669228196368538810102604",
"148001532627403463689725855116298786095"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/test/HTTPTransactionWebTransportTest.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-832b290d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"198588761747353280577210119262493986369",
"287619295498267682603114540902823641432",
"273515210669057555610222001104097289783",
"170965080193446236866679796902379650545",
"227002004891221114505322732676416547552",
"249547429439204127114734829503424671048",
"90829697753508615150294958528033364598",
"280297037902785440476728202059257853970",
"56332611574532847384424834577444707049",
"53775454293491746559508685878635775106",
"92680149783186707536654268128325449814",
"130625231777626024984609938149361786757",
"218116226973505798294174729410315413158",
"74946665258245815869525933107927553854",
"233885721783719363171211575312746934305",
"248146184630959448682506588632487988936",
"2007133905042070295497887770888225947",
"308478698069779397249817773161094345521",
"260908434002106757859982718809126304400",
"178739337037696576153486037911669057983",
"251898469951712675295042233943040483361",
"123050193975104041898066339048126582141",
"337800351894538811354456688996280628008",
"227608220456227191643674578766931293991",
"9998647003565824380061891290841632301",
"309980392440695610762302696906987671088",
"302265871672795071260406768182361010417",
"63338511660062892466626106134585461814",
"78567228824380859699802474734753953232",
"295820141081969884781350203859080052536",
"156370434458544128293870014883250682374",
"305389336451726275032224680798171018138",
"316097928521469009789072861102745556522",
"123997707233028498703523024034933907809",
"128697365277188360871734057477821511511"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/test/HTTPBinaryCodecTest.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-9b57e8fc",
"digest": {
"length": 581,
"function_hash": "46050150011650082201885137354165849678"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/webtransport/WebTransportImpl.cpp",
"function": "WebTransportImpl::terminateSessionStreams"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-9ed58b9f",
"digest": {
"length": 542,
"function_hash": "189383824846132347639841209449055202390"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp",
"function": "HQSession::deliverWTStream"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-aa8220f4",
"digest": {
"length": 1502,
"function_hash": "215627226419630136009871299795471294744"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/test/HTTPTransactionWebTransportTest.cpp",
"function": "TEST_F"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-b44ec878",
"digest": {
"length": 1065,
"function_hash": "98085346050739968651843367189070773472"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/HTTPBinaryCodec.cpp",
"function": "HTTPBinaryCodec::parseSingleHeaderHelper"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-b80404c9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"51260867160464289970018837867978420453",
"296732215517578265004150613535020400094",
"259850419858382852086213735415389585528",
"174020160013018801152592946712577082741",
"293348073276470877290288160588781275266",
"213079880044365832940691632302752115673",
"38289846949371947904097303663861354315",
"240003882947427586718525293913244062398",
"167752838730762168705812275673979418997",
"248305204380683032150790823179092163126",
"196677913965043003433017333820025128829",
"306765825440982933810932930054210198174",
"109286659046918832018707472159105696946",
"191854202393079040346399443891608305347",
"8953023373976796538123480898488859067",
"339774319927855888550252678067727710694",
"262003970451043329541045678753265389279"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/HTTPTransaction.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-c205c00c",
"digest": {
"length": 1071,
"function_hash": "66652873698882478867363952741985214526"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/HTTPBinaryCodec.cpp",
"function": "HTTPBinaryCodec::parseKnownLengthHeadersHelper"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-d1f0762f",
"digest": {
"length": 773,
"function_hash": "120716554370594194714095577854795894574"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/test/HTTPBinaryCodecTest.cpp",
"function": "TEST_F"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-d36179ee",
"digest": {
"length": 979,
"function_hash": "61175608856746199469907870208243130006"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/HTTPBinaryCodec.cpp",
"function": "HTTPBinaryCodec::parseIndeterminateLengthHeadersHelper"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-e650d103",
"digest": {
"length": 2186,
"function_hash": "143271683207194779193896082027242771952"
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/test/HTTPBinaryCodecTest.cpp",
"function": "TEST_F"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-e9472108",
"digest": {
"threshold": 0.9,
"line_hashes": [
"314870076066756790480238215501967856089",
"196906496449945267946841204072156051166",
"5934697323121432226963149248939020198",
"119762308929219233563459374894842023064",
"59385509429970112302183107699361717440",
"263186850078004563602628979963971116193",
"311150334828024886208079118118657904358",
"9855676066652703770592765571886967033",
"8604333367526276201646784369970082266",
"281375968432018702303116441449990503721",
"211700959628837076573913573609867922259",
"50033286686377535444160484799826280563",
"269431742105966120093116308406201300237",
"37191515900254218544701813215908192915",
"174933785823935401808058909413992091193",
"47045438881583103884697066740963267263",
"116289058542489871814870772190452197164",
"119081684893706823574469255523320301596",
"144818394407159821278851507451077332624"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/session/HQSession.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-ec3dfe5c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"83245271756198010134741001823942610990",
"299669869304276703338440383649054372573",
"226582523696706609996562958601196516",
"281557968970722656062437551959807381007",
"199513496538458816810802582886512500845",
"238876599428321897179539324591097401614",
"115748378406312463196902625358695910063",
"94033375552324928903470076570831912219",
"243260750938455949458939422054330517231",
"29707469399295268960196166389302912782",
"305718501069518756709455730350954958910",
"109410887196358393440897692053077258174",
"165144474503689356406556881023927473878",
"95037916448484320522635014797161341937",
"265869371132829933193215819436732561359",
"144880702791867449029342333074563777905",
"76336025403513631187950607999242005686",
"310339125962432334920349889563007483663",
"52803539332189276749410642782143201503",
"153799147879729027298361764770614540156",
"159080432430864559451850344221604147236",
"320403108991802458655286320192533041709",
"288432346420496630293676977034514218368",
"79876962555014789457126971110242759917",
"253944608635896563282375595357974631311",
"302564848089356098514076390233834451814",
"283487834770972316989190370028909432862",
"264264234873436168286404322222434660697",
"45112741605424686592674323051785253552",
"303081883564621431500350078136116198917",
"108408069611167837081955414103110905720",
"324696532373540080626276145306297556920",
"297304809923547449873585740319568271291",
"104954415314117193950453145593029720551",
"65880837761704270731461423848645431808",
"124174558209123355897276395554923748311",
"126897464108676922302258246998208346057",
"59915361624729266320177592579998154889",
"215976014756197565731680461262114047883",
"277237052180412549221312802034926645985",
"99032022135399322117322111889436203394",
"69089115454770749497236017464331303489",
"16636630895039558866248437509109290029",
"164060320022479706035523193311588754300",
"113879765881165852139914186845960650612",
"297304809923547449873585740319568271291",
"152295484194584322473856300045401420256",
"91991039552569764812167405112671452832",
"226277509508932958241714411647859108785",
"273930241697271523863683736324054807015",
"121777001640370697799368937472609658937",
"73294418974141893014245286393669453956",
"180618518071059241881980197282746903093",
"117005836857959356817116774869008128069",
"22982055759860080464907168680531541838",
"318658949538662481234825113935549890649",
"103344132170392711120178744710241994506",
"26928593228105281475231901400549899071",
"178613283415951262320023357231845447979",
"316831456150515652736374052506484012122",
"4751992420457423879360300505204544031",
"165994204635720418494377142954268772754",
"334271704830525570092909166400591635323",
"15418856847596032898933758351731912422",
"149354152215625161439360975253319311575",
"254790119174337049041536028991041650331"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/HTTPBinaryCodec.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-edd1ecc6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"198791346169858981760051286844265837840",
"10618709560399588958624880069708337995",
"327503127466038172309656907618937737003",
"69391518485499617172259013806817967977"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/codec/HTTPBinaryCodec.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84895-ff3d051c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"318052132457781640979913556930012185650",
"83152031357150843091651076777282063938",
"214538714547114560447164344935041512108",
"60487055733731142501725378488306360534",
"82394485833878665106173188306941294171",
"170981450380513231728977972824399814762",
"329187022535073464345423760023084307574",
"301359881130799083610048326964802093149",
"144093622686669802483341790375341517229",
"138678768339663197215198891311144953617",
"115402135902211922541220153708938209002",
"127976195365999170477452852766946404198",
"33785489405449112044603055862857658709",
"326547988490764536006021771675750664152",
"298391830917019990997138209257878240316",
"256678923333674571940019897387316265854",
"291609617207747735530723362218837367902",
"54743421487913933725999769063508448483",
"182335656734203625258404272381538853851",
"16246722329777042441286867735536111185",
"333646990514192870592407655481741215644",
"175866923493703334701276856361018499154",
"290462143393795448302385270925897062861",
"92384186428506932804727176941938266427",
"186413320829794478795742937750133761526",
"197945429890246287184935173745537246043",
"114892258021372890465648230794437997983",
"304755951958968378137358028028808033405"
]
},
"source": "https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083",
"target": {
"file": "proxygen/lib/http/webtransport/WebTransportImpl.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T17:56:34Z"
}
}
],
"modified": "2026-10-20T17:56:34.131027196Z",
"provider": "osv",
"references": [
"https://www.facebook.com/security/advisories/cve-2026-84895",
"https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-84895",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 390127,
"published_at": "2026-09-28T21:17:19.027+00:00"
}