Unscored CVE-2019-11924 EUVD-2019-3582GHSA-w38x-26w3-8j5j

A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resu…

Published Aug 20, 2019 · Updated Aug 4, 2024 · Assigned by facebook

Description

A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.

Affected products

Vendor	Product	Affected	Fixed
Facebook	fizz	v2019.08.12.00, v2019.01.28.00 – < unspecified	unspecified

References

https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994b
https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52f
https://www.facebook.com/security/advisories/cve-2019-11924