Unscored CVE-2019-11923 EUVD-2019-3581GHSA-wjxh-p937-x4v8

In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforce…

Published Dec 4, 2019 · Updated Aug 4, 2024 · Assigned by facebook

Description

In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.

Affected products

Vendor	Product	Affected	Fixed
Facebook	Mcrouter	0.41.0, unspecified – < 0.41.0	0.41.0

References

https://www.facebook.com/security/advisories/cve-2019-11923
https://github.com/facebook/mcrouter/releases/tag/v0.41.0-release
https://github.com/facebook/mcrouter/commit/98ce6624cd2563cfdb5da3b2949d5e1e03867034