CVE-2019-3552: High severity thrift vulnerability
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-3552?
CVE-2019-3552 is a vulnerability in C++ Facebook Thrift servers (using cpp2) that allows malicious clients to send short messages, causing denial of service.
What is the severity of CVE-2019-3552?
The severity of CVE-2019-3552 is high (7.5).
Which software is affected by CVE-2019-3552?
Facebook Thrift version up to and excluding 2019.02.18.00 is affected by CVE-2019-3552.
How can a malicious client exploit CVE-2019-3552?
A malicious client can exploit CVE-2019-3552 by sending messages with containers of fields of unknown type, causing the server to take a long time to parse the message and potentially leading to denial of service.
Is there a fix for CVE-2019-3552?
Yes, the issue has been addressed in a commit by Facebook. It is recommended to update to a version that includes the fix.