How severe is CVE-2018-6343?

CVE-2018-6343 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2018-6343 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-6343?

CVE-2018-6343 affects Facebook Proxygen. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-6343?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-6343 published?

CVE-2018-6343 was published on 2018-12-31 and last updated on 2026-06-17.

CVE-2018-6343

CVE-2018-6343 is a high-severity vulnerability in Facebook Proxygen with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-20
Affected product: Facebook Proxygen
Published: 2018-12-31
Last modified: 2026-06-17

Description

Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.

Frequently asked questions

What is CVE-2018-6343?: Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
How severe is CVE-2018-6343?: CVE-2018-6343 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2018-6343 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-6343?: CVE-2018-6343 affects Facebook Proxygen. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-6343?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-6343 published?: CVE-2018-6343 was published on 2018-12-31 and last updated on 2026-06-17.

References

https://github.com/facebook/proxygen/commit/0600ebe59c3e82cd012def77ca9ca1918da74a71

Affected products (1)

cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*

More vulnerabilities in Facebook Proxygen

CVE-2020-1897 — Critical (CVSS 9.8): A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client…
CVE-2019-11940 — Critical (CVSS 9.8): In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize…
CVE-2019-11921 — Critical (CVSS 9.8): An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper…
CVE-2023-44487 — High (CVSS 7.5): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset…
CVE-2021-24029 — High (CVSS 7.5): A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a…
CVE-2025-55181 — Medium (CVSS 5.3): Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in…

All CVEs affecting Facebook Proxygen →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →