A vulnerability in proxygen's QPACK decoder allows a remote unauthenticated HTTP/3 peer to cause unbounded memory consumption by sending an insert instruction with an arbitrarily large string literal on the encoder stream. The decoder only enforces the size limit after receiving the entire literal, leading to memory exhaustion and denial of service. This affects proxygen versions prior to v2026.11.09.00.