CVE-2019-11938CWE-770

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload

published March 10, 2020

CVSS
—
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02252 · 82.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2020-03-10T20:30Z
EPSS history
Timeline
  • 10 MAR 20:30Z
    Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload
    cvelistv5