Riskcovery

CVE-2021-24029

State
Published
Severity
Not scored
Published
Mar 15, 2021
Updated
Aug 3, 2024
Reserved
Jan 13, 2021

Read the record on cve.org

Description

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-617 Reachable Assertion (CWE-617)

Affected Products

ProductVersions
mvfstFacebook
  • a67083ff4b8dcbb7ee2839da6338032030d712b0 to before unspecifiedNot affected
  • before a67083ff4b8dcbb7ee2839da6338032030d712b0Affected
proxygenFacebook
  • v2021.03.15.00 to before unspecifiedNot affected
  • before v2021.03.15.00Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.