This vulnerability affects HTTP/2 server implementations like Facebook proxygen that do not adequately limit resource consumption when buffering response data during stalled flow-control conditions. Specifically, when a client advertises SETTINGS_INITIAL_WINDOW_SIZE=0 or withholds WINDOW_UPDATE frames, the server continues generating full response bodies but cannot send them, causing buffered data to accumulate in memory. An attacker can open many streams requesting large resources, causing memory exhaustion, swap thrashing, and potential system crashes or service unavailability. The vulnerability is tracked as CVE-2026-44909 with a CVSS 3.1 score of 7.5 (high severity).

A remote, unauthenticated attacker can cause denial-of-service by exhausting server memory and connection resources. Under permissive resource limits, this can lead to out-of-memory kills, severe swap thrashing, or full system unresponsiveness. Under default or lower limits, the attack can exhaust worker or connection resources, degrading service availability and preventing new client sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Several vendors have addressed this vulnerability in recent updates. Mitigations include enforcing memory ceilings, restricting concurrent stream counts, and actively terminating stalled connections to reduce the risk of denial-of-service conditions.