Use-after-free during session closure in Facebook proxygen

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.

• Facebook proxygen: affected from v2026.04.06.00 through versions less than v2026.09.28.00, according to the structured affected data. The default status outside that declared range is unaffected.
• Version boundary: v2026.09.28.00 is outside the declared affected range and is the release to deploy in place of an affected build. Do not infer the status of parallel branches or other release lines without checking them separately.
• Red Hat: Red Hat VEX marks all currently supported Red Hat products as known not affected because proxygen is not shipped or supported in those products. That conclusion does not extend to community environments or self-built deployments.

Facebook proxygen contains a flaw in QuicWtSession::closeSession, which continues to access member fields after calling QuicWtSessionBase::closeSession. The base method notifies the session handler, and that handler may release the last reference to the session and destroy the object. Execution then returns to the derived method, which accesses data belonging to the destroyed object, resulting in a Use After Free condition classified as CWE-416. The supplied assessment describes network reachability without requiring privileges or user interaction, but it does not disclose the triggering request, protocol message, or exact activation sequence. The specific member fields accessed after release and other implementation details remain unknown.

• Reachability: The flaw is assessed as remotely reachable over the network.
• Conditions: The supplied record characterizes exploitation as low complexity, requiring no authentication or special privileges and no user interaction.
• Documented outcome: Red Hat describes application crashes and Denial of Service during session closure; memory corruption is a possible consequence but no specific exploit is established.
• Exploitation status: The normalized record marks public_exploit as false and leaves known_exploited unset. The CISA ADP enrichment returned during research marks exploitation as none at its assessment point. This does not establish that exploitation will not occur in the future.
• No concrete request sequence or payload is provided.

When triggered, the session may be destroyed while QuicWtSession::closeSession is still executing, causing subsequent member-field accesses to use freed memory. The outcome documented by Red Hat is an application crash and Denial of Service; memory corruption is a potential consequence of the use-after-free. The flaw is assessed as network reachable without requiring privileges or user interaction. The available evidence does not confirm privilege escalation, code execution, a specific data-disclosure scenario, or a named victim.

Services using an affected Facebook proxygen version may be disrupted if a remote network client triggers the flaw while a session is closing. The confirmed consequence in the available evidence is an application crash and Denial of Service, which may require process restart, connection recovery, or service restoration. A use-after-free also creates the possibility of memory corruption, but the evidence does not establish a specific data-disclosure, takeover, or code-execution scenario. Exposure is limited to applications actually deploying an affected proxygen build; Red Hat states that proxygen is not shipped or supported in its currently supported products.

1. Upgrade Facebook proxygen to v2026.09.28.00. This is the version boundary outside the supplied affected range and the primary remediation supported by the record.
2. Check all artifacts, lockfiles, images, and deployed binaries to ensure that no version from v2026.04.06.00 through a version less than v2026.09.28.00 remains in service.
3. After upgrading, verify the version actually loaded by each application and test the QuicWtSession closure path in a controlled environment.
4. No specific workaround or configuration mitigation is provided in the available evidence. If an upgrade is not immediately possible, temporarily restricting untrusted network access to applications using an affected build may reduce reachability, but this is precautionary and is not a substitute for the fix.

1. Inventory applications and artifacts that embed or link Facebook proxygen, especially deployments using QuicWtSession.
2. Check the exact deployed version. Versions starting at v2026.04.06.00 and less than v2026.09.28.00 are within the affected range that requires review.
3. If source is available, inspect QuicWtSession::closeSession and verify that it does not access member fields after calling QuicWtSessionBase::closeSession.
4. Review crash, restart, or process-loss telemetry occurring near QUIC or WebTransport session closure. This is precautionary monitoring, not a confirmed indicator of compromise.
5. Do not treat the absence of crash logs as proof that a deployment is safe. No specific log signature or IOC is provided by the available evidence.