Not rated
CVE-2019-11938 Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the…
Description
Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Facebook Thrift 2019.12 | earliest → < 2019.12.09.00 | 2019.12.09.00 |
Other CVEs of Facebook Thrift
The 11 CVEs of Facebook Thrift →
CVE-2024-45863
A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to…
5.3
Medium
CVE-2024-45773
A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially…
7.5
High
CVE-2021-24028
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code…
Not rated
CVE-2019-11939
Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the…
Not rated