CVE-2019-3553CWE-770

C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload

published March 10, 2020

CVSS
—
EPSS
2%
Percentile
81.8
In the wild
Unconfirmed
What it is

C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02128 · 81.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2020-03-10T20:30Z
EPSS history
Timeline
  • 10 MAR 20:30Z
    C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload
    cvelistv5