Facebook vulnerabilities
Every vulnerability this feed holds for Facebook, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
7 vulnerabilities tracked.
- — When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before…
- — When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based…
- — In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding…
- — An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already…
- — proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had…
- — proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a…
- — mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Facebook is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Microsoft Linux Red Hat IBM n/a Apple Google Apache Software Foundation Oracle Corporation zephyrproject Unknown FFMPEG Adobe Drupal SAP_SE Cisco Eclipse Foundation OpenEMR go-vikunja hickory-dns n8n-io Hitachi Grafana HCL Software