Denial of Service Vulnerability in Facebook Thrift by Golang
CVE-2019-11939

7.5HIGH

Key Information:

Vendor

Facebook

Status
Facebook Thrift
Vendor
CVE Published:
18 March 2020

What is CVE-2019-11939?

This vulnerability in Facebook Thrift, a framework developed in Golang, allows malicious clients to manipulate memory allocation by sending short messages that result in oversized container declarations. This behavior can lead to excessive memory consumption, exposing systems to potential denial of service attacks. Affected versions include those prior to v2020.03.16.00, which could crash or degrade the performance of the Thrift servers significantly.

Affected Version(s)

Facebook Thrift < unspecified

Facebook Thrift v2020.03.16.00

References

https://github.com/facebook/fbthrift/commit/483ed864d69f3...
x_refsource_MISC
https://www.facebook.com/security/advisories/cve-2019-11939
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.