The SPDY/2 codec in Facebook Proxygen prior to 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
proxygen project proxygen