rootpwn

critical · CVSS v3 9.8

CVE-2026-91095

The vulnerability in proxygen's HTTPTransaction APIs can expose freed memory to attackers. It affects versions from v2024.10.28.00 to v2026.

Overview

The vulnerability in proxygen's HTTPTransaction APIs can expose freed memory to attackers. It affects versions from v2024.10.28.00 to v2026.09.28.00. It allows potential memory corruption or crash.

Description

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.

Impact

Confidentiality: potential memory disclosure. Integrity: possible memory corruption. Availability: crash or denial of service. Defenders using affected proxygen versions are at risk.

Remediation

Upgrade proxygen to v2026.10.00.00 or later. If upgrade not possible, disable WebTransport or configure HTTPTransaction to validate stream handles before use.

Risk context

Critical severity (CVSS 9.8) indicates high risk; immediate attention recommended.

Affected products

  • proxygen

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.8
CVSS v4
—
EPSS
—

memory-safety use-after-free proxygen webtransport critical denial-of-service

← All CVEs

Related CVEs

critical

CVE-2026-101261

Ziroom ZHOME A0101 firmware 1.0.1.0 contains a command injection vulnerability in the /api/ZRnetwork/firstSetup_wifi endpoint. Remote attackers can supply a crafted login_pwd parameter to execute arbitrary commands. This flaw could allow full compromise of the device.

View analysis

critical

CVE-2026-101354

A stack-based buffer overflow exists in the _tWlanTask function of the MmtAtePrase Parser in FAST FAC1203R firmware 20200116_2.0.4. The flaw can be triggered by a local network attacker and may allow arbitrary code execution. The vulnerability is rated critical with a CVSS v3 score of 9.6.

View analysis

critical

CVE-2026-101860

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-102240

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis