CVE-2019-11938: High severity thrift vulnerability
Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-11938?
CVE-2019-11938 is a vulnerability found in Java Facebook Thrift servers that allows malicious clients to send short messages resulting in a large memory allocation, potentially leading to denial of service.
How does CVE-2019-11938 affect Facebook Thrift?
CVE-2019-11938 affects Facebook Thrift by allowing malicious clients to send messages declaring containers of sizes larger than the payload, leading to a large memory allocation and potential denial of service.
What is the severity of CVE-2019-11938?
CVE-2019-11938 has a severity value of 7.5 (high).
How can I fix CVE-2019-11938?
To fix CVE-2019-11938, update your Java Facebook Thrift servers to version 2019.12.09.00 or higher where the vulnerability has been patched.
Where can I find more information about CVE-2019-11938?
You can find more information about CVE-2019-11938 in the following references: [GitHub Commit 1](https://github.com/facebook/fbthrift/commit/08c2d412adb214c40bb03be7587057b25d053030), [GitHub Commit 2](https://github.com/facebook/fbthrift/commit/71c97ffdcb61cccf1f8267774e873e21ebd3ebd3), [Facebook Security Advisories](https://www.facebook.com/security/advisories/cve-2019-11938).