CVE-2018-6347

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-20

Affected software

Vendor	Product	Versions
Facebook	Proxygen	v2018.12.31.00; >= unspecified, <= v2018.12.31.00

References

https://github.com/facebook/proxygen/commit/223e0aa6bc7590e86af1e917185a2e0efe160711Patch, Third Party Advisory
https://github.com/facebook/proxygen/commit/223e0aa6bc7590e86af1e917185a2e0efe160711Patch, Third Party Advisory

Timeline

Published: Dec 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-63499.8When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overfl CVE-2018-63509.8An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android pr CVE-2018-63525.5In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers coul CVE-2018-63537.8The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering CVE-2018-63546.1templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.CVE-2018-63556.1/goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the la CVE-2018-63566.5Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs CVE-2018-63578.8The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via th CVE-2018-63588.8The printDefineFont2 function (util/listfdb.c) in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attac CVE-2018-63598.8The decompileIF function (util/decompile.c) in libming through 0.4.8 is vulnerable to a use-after-free, which may allow attackers to cause a CVE-2018-63608.8mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDE CVE-2018-63616.1Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account.