CVE-2018-6346: facebook proxygen Uncontrolled Resource Consumption
CVSS: 7.5v3.1HighModified
Published 31-12-2018Last modified 06-05-2025
Vulnerability summary
CVE-2018-6346 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in facebook proxygen. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 71.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.37%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 31-12-2018PublishedVulnerability first disclosed.
- 06-05-2025Last modifiedVulnerability information updated.
Description
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen prior to v2018.12.31.00.
CVSS metrics
4 scores · 2 sources · 3 versionsHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 2 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.37%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.37% on 19-09-2026
19-09-202619-10-2026
EPSS score1.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-3887PK - ErrorsThis category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."
Affected systems
Facebook1 product
- proxygenv2018.12.31.00 | ≥ unspecified, < v2018.12.31.00
Proxygen_project1 product
- proxygen< 2018.12.31.00
2 vendors · 2 products
References
1 links- github.com/facebook/proxygen/commit/52cf331743ebd74194d6343a6c2ec52bb917c982X Refsource MISCPatchThird Party Advisory