CVE-2019-11939CWE-770

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload

published March 18, 2020

CVSS
—
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01557 · 75.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2020-03-18T00:40Z
EPSS history
Timeline
  • 18 MAR 00:40Z
    Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload
    cvelistv5