cve.bz

CVE-2019-11939

7.5 highEPSS 1.6%

High (7.5) in facebook thrift. EPSS 1.6% chance of exploitation in the next 30 days. Fixed in github.com/facebook/fbthrift 0.31.1-0.20200311080807-483ed864d69f.

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE
CWE-770
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-w3r9-r9w7-8h48Gogithub.com/facebook/fbthrift<0.31.1-0.20200311080807-483ed864d69f0.31.1-0.20200311080807-483ed864d69f
GO-2021-0082Gogithub.com/facebook/fbthrift<0.31.1-0.20200311080807-483ed864d69f0.31.1-0.20200311080807-483ed864d69f

References

Check your stackJSON