Skip to content
OpenAdvisories
Unscored CVE-2019-11938 EUVD-2019-3595GHSA-hr4p-8hm2-w85x

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, ma…

Published Mar 10, 2020 · Updated Aug 4, 2024 · Assigned by facebook

Description

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.

Affected products

VendorProductAffectedFixed
Facebook Facebook Thrift unspecified – < v2019.12.09.00 v2019.12.09.00

References