high7.5
CVE-2019-11938
Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload.
Impact
Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Thrift | before 2019.12.09.00 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/facebook/fbthrift/commit/08c2d412adb214c40bb03be7587057b25d053030
- https://github.com/facebook/fbthrift/commit/71c97ffdcb61cccf1f8267774e873e21ebd3ebd3
- https://www.facebook.com/security/advisories/cve-2019-11938
- https://github.com/facebook/fbthrift/commit/08c2d412adb214c40bb03be7587057b25d053030
- https://github.com/facebook/fbthrift/commit/71c97ffdcb61cccf1f8267774e873e21ebd3ebd3
- https://www.facebook.com/security/advisories/cve-2019-11938