{"id":"CVE-2025-55181","state":"PUBLISHED","title":"Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and uncondit","description":"Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.","publishedAt":"2025-12-02T22:13:31.101Z","updatedAt":"2025-12-03T00:33:57.022Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"Meta"},"assigner":"Meta","products":["Facebook proxygen"],"affected":[{"vendor":"Facebook","product":"proxygen","defaultStatus":"unaffected","versions":[{"version":"v2025.08.25.00","status":"affected","lessThanOrEqual":"v2025.12.01.00","versionType":"semver"}]}],"references":["https://www.facebook.com/security/advisories/cve-2025-55181","https://github.com/facebook/proxygen/commit/17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f"],"weaknesses":["CWE-834"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/55xxx/CVE-2025-55181.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-55181","state":"PUBLISHED","datePublished":"2025-12-02T22:13:31.101Z","dateUpdated":"2025-12-03T00:33:57.022Z","assignerShortName":"Meta","assignerOrgId":"4fc57720-52fe-4431-a0fb-3d2c8747b827","dateReserved":"2025-08-08T18:21:47.119Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory."}],"affected":[{"vendor":"Facebook","product":"proxygen","defaultStatus":"unaffected","versions":[{"version":"v2025.08.25.00","status":"affected","lessThanOrEqual":"v2025.12.01.00","versionType":"semver"}]}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-55181","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/facebook/proxygen/commit/17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f","tags":["x_refsource_CONFIRM"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"description":"Excessive Iteration (CWE-834)","lang":"en"}]}],"providerMetadata":{"shortName":"Meta","orgId":"4fc57720-52fe-4431-a0fb-3d2c8747b827","dateUpdated":"2025-12-02T22:13:31.101Z"},"dateAssigned":"2025-12-01T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-03T00:33:16.510713Z","id":"CVE-2025-55181","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-834","type":"CWE","lang":"en","description":"CWE-834 Excessive Iteration"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-03T00:33:57.022Z"}}]}}}