CVE-2025-55181
📋 TL;DR
This vulnerability in Proxygen's HTTPQuicCoroSession allows an attacker to trigger an infinite loop and unbounded memory growth by sending HTTP request/response bodies larger than 2^31 bytes. This leads to denial of service as the process eventually runs out of memory. Systems using vulnerable versions of Proxygen for HTTP/QUIC handling are affected.
💻 Affected Systems
- Facebook Proxygen
📦 What is this software?
Proxygen by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service with process crash due to memory exhaustion, potentially affecting all services using the vulnerable Proxygen component.
Likely Case
Service disruption through resource exhaustion, requiring process restart and causing temporary unavailability.
If Mitigated
Limited impact with proper request size limits and monitoring in place, potentially causing only temporary performance degradation.
🎯 Exploit Status
The vulnerability is straightforward to exploit but requires the attacker to send >2GB of data, which may be detectable through network monitoring.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f or later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2025-55181
Restart Required: Yes
Instructions:
1. Update Proxygen to commit 17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f or later. 2. Rebuild any applications using Proxygen. 3. Restart affected services.
🔧 Temporary Workarounds
Implement HTTP request size limits
allConfigure maximum HTTP request/response body size limits to prevent sending >2^31 byte payloads.
# Configure in application using Proxygen or upstream load balancer
# Example for nginx: client_max_body_size 1G;
Disable QUIC/HTTP3 if not required
allDisable QUIC/HTTP3 support if not needed, as vulnerability only affects HTTPQuicCoroSession.
# Configure Proxygen to disable QUIC support
# Check Proxygen configuration for QUIC/HTTP3 settings
🧯 If You Can't Patch
- Implement strict network-level request size filtering at load balancers or firewalls
- Deploy memory monitoring and automatic restart policies for Proxygen processes
🔍 How to Verify
Check if Vulnerable:
Check Proxygen version/git commit. If before 17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f and using HTTP/QUIC, system is vulnerable.Check Version:
git log --oneline -1 # in Proxygen source directory, or check application version informationVerify Fix Applied:
Verify Proxygen is at commit 17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f or later and test with large HTTP payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual memory consumption spikes
- Process crashes/restarts
- Large HTTP request/response logs (>2GB)
Network Indicators:
- HTTP requests with extremely large body sizes
- Unusual QUIC/HTTP3 traffic patterns
SIEM Query:
source="proxygen.log" AND ("memory" OR "crash" OR "restart") OR http.request.size > 2147483648