How severe is CVE-2025-55181?

CVE-2025-55181 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2025-55181 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-55181?

CVE-2025-55181 affects Facebook Proxygen. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-55181?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-55181 have an EU (EUVD) identifier?

Yes. CVE-2025-55181 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-200372.

When was CVE-2025-55181 published?

CVE-2025-55181 was published on 2025-12-02 and last updated on 2026-06-17.

CVE-2025-55181

CVE-2025-55181 is a medium-severity vulnerability in Facebook Proxygen with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-834.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-200372
Weakness: CWE-834
Affected product: Facebook Proxygen
Published: 2025-12-02
Last modified: 2026-06-17

Description

Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.

Frequently asked questions

What is CVE-2025-55181?: Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
How severe is CVE-2025-55181?: CVE-2025-55181 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2025-55181 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-55181?: CVE-2025-55181 affects Facebook Proxygen. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-55181?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-55181 have an EU (EUVD) identifier?: Yes. CVE-2025-55181 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-200372.
When was CVE-2025-55181 published?: CVE-2025-55181 was published on 2025-12-02 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*

More vulnerabilities in Facebook Proxygen

CVE-2020-1897 — Critical (CVSS 9.8): A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client…
CVE-2019-11940 — Critical (CVSS 9.8): In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize…
CVE-2019-11921 — Critical (CVSS 9.8): An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper…
CVE-2023-44487 — High (CVSS 7.5): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset…
CVE-2021-24029 — High (CVSS 7.5): A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a…
CVE-2018-6343 — High (CVSS 7.5): Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of…

All CVEs affecting Facebook Proxygen →

Other CWE-834 (Excessive Iteration) vulnerabilities

CVE-2017-12587 — High (CVSS 8.8): ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c.
CVE-2025-62707 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this…
CVE-2025-56571 — High (CVSS 7.5): Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper…
CVE-2024-4227 — High (CVSS 7.5): In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when…
CVE-2023-49316 — High (CVSS 7.5): In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.
CVE-2023-5632 — High (CVSS 7.5): In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data…

Browse all CWE-834 (Excessive Iteration) vulnerabilities →