CVE-2019-3564: Input Validation
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-3564?
CVE-2019-3564 is a vulnerability that affects Go Facebook Thrift servers and could potentially lead to denial of service.
How does CVE-2019-3564 affect Facebook Thrift?
CVE-2019-3564 affects Facebook Thrift servers by allowing malicious clients to send short messages that could take a long time for the server to parse, potentially leading to denial of service.
What is the severity of CVE-2019-3564?
The severity of CVE-2019-3564 is high with a CVSS score of 7.5.
How do I fix CVE-2019-3564?
To fix CVE-2019-3564, update Facebook Thrift to version 0.31.1-0.20190225164308-c461c1bd1a3e or later.
Where can I find more information about CVE-2019-3564?
You can find more information about CVE-2019-3564 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-3564), [GitHub](https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156), [Apache Mailing List](https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E).