CVE-2019-11939

Summary

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.

Affected Software

VendorProductVersion RangeStatus
FacebookFacebook Thriftv2020.03.16.00 < unspecifiedunaffected
FacebookFacebook Thriftunspecified < v2020.03.16.00affected

Weaknesses

  • CWE-770: Allocation of Resources Without Limits or Throttling (CWE-770)

ADP Enrichment

CVE Program Container

Additional References

References