CVE-2026-91095

MediumCVSS 5.3/10Last modified Sep 30, 2026

Description

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Sep 28, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-910967.5In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases beforCVE-2026-910979.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-910989.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-910999.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-91104.2Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renCVE-2026-911009.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911019.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911029.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911039.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911049.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911059.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911069.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components
CVE-2026-91095: Medium severity, CVSS 5.3 | Vulnix