What is GHSA-ppxw-566f-wjp6?

GHSA-ppxw-566f-wjp6 is a security advisory published by GitHub Security Advisories with High severity. In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its...

Which CVE IDs does GHSA-ppxw-566f-wjp6 cover?

GHSA-ppxw-566f-wjp6 covers the following CVE IDs: CVE-2026-84895. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ppxw-566f-wjp6?

GHSA-ppxw-566f-wjp6 has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

GHSA-ppxw-566f-wjp6HighCVSS 7.3

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its...

Vendor

GitHub Security Advisories

Published

September 28, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-84895 →

📋 Description

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-84895
https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083
https://www.facebook.com/security/advisories/cve-2026-84895
https://github.com/advisories/GHSA-ppxw-566f-wjp6