{"metadata": {"vulnerability": "CVE-2026-119235", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00.000Z", "kind": "other", "label": "Date Assigned", "source": "cvelistv5 / Meta", "record": "CVE-2026-119235", "field": "containers.cna.dateAssigned"}, {"timestamp": "2026-10-29T17:01:32.523Z", "date_only": false, "value": "2026-10-29T17:01:32.523Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119235", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-11T16:54:58.688Z", "date_only": false, "value": "2026-11-11T16:54:58.688Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119235", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T16:54:58.688Z", "date_only": false, "value": "2026-11-11T16:54:58.688Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119235", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-11T16:54:58.688Z", "date_only": false, "value": "2026-11-11T16:54:58.688Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Meta", "record": "CVE-2026-119235", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-11T17:17:16Z", "date_only": false, "value": "2026-11-11T17:17:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CQQ6-62V8-G6MG", "record": "GHSA-CQQ6-62V8-G6MG", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-11T17:17:16.663Z", "date_only": false, "value": "2026-11-11T17:17:16.663", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119235", "record": "FKIE_CVE-2026-119235", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T17:17:16.760Z", "date_only": false, "value": "2026-11-11T17:17:16.760", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119235", "record": "FKIE_CVE-2026-119235", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T18:28:57.014Z", "date_only": false, "value": "2026-11-11T18:28:57.014440Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117599222921436954", "record": "cve-2026-119235", "field": "creation_timestamp", "uuid": "256fab47-6359-4f5f-ad1f-63dbd2765b47", "content": "CVE-2026-119235  proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and then keep sending data, causing the decoder to buffer it without bound for the lifetime of the connection and exhaust memory, leading to denial of service. The issue occurs regardless of the advertised QPACK dynamic table capacity, including when the dynamic table is disabled. This issue affects proxygen versions prior to v2026.11.09.00.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119235https://www.facebook.com/security/advisories/cve-2026-119235https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781#Facebook #proxygen#CVE_2026_119235#bot", "url": "https://infosec.exchange/users/cve/statuses/117599222921436954"}, {"timestamp": "2026-11-11T18:31:37Z", "date_only": false, "value": "2026-11-11T18:31:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CQQ6-62V8-G6MG", "record": "GHSA-CQQ6-62V8-G6MG", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T18:31:37Z", "date_only": false, "value": "2026-11-11T18:31:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CQQ6-62V8-G6MG", "record": "GHSA-CQQ6-62V8-G6MG", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-12T04:57:35.330Z", "anchors": {"origin": {"timestamp": "2026-11-11T16:54:58.688Z", "date_only": false, "value": "2026-11-11T16:54:58.688Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119235", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-11T16:54:58.688Z", "date_only": false, "value": "2026-11-11T16:54:58.688Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119235", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 43356.642273, "hours": 12.0435117425, "days": 0.5018129892708333, "min_seconds": 43356.642273, "max_seconds": 43356.642273, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T16:54:58.688Z", "date_only": false, "value": "2026-11-11T16:54:58.688Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119235", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T04:57:35.330Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}