CVE-2019-3565

Summary: CVE-2019-3565 affects legacy Facebook Thrift servers (cpp, not cpp2). The root cause is that servers would not error when receiving messages containing containers of fields with unknown types, enabling malicious clients to send short messages that force long parsing times and cause denia...

CVE-2019-3558

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook...

CVE-2019-3565

Legacy C++ Facebook Thrift servers using cpp instead of cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service...

CVE-2019-3552

CVE-2019-3552 affects Facebook Thrift servers (cpp2). The issue occurs when the server accepts messages containing containers with fields of unknown type, which can cause the server to parse lengthy requests and permit denial of service. Public documents consistently state that this affects Thrif...

CVE-2019-3564

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift...

CVE-2019-3564

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift...

CVE-2019-3552

C++ Facebook Thrift servers using cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects...

CVE-2019-3559

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thri...

CVE-2019-3558

CVE-2019-3558 affects the Facebook Thrift server implementation. The issue arises when Python Facebook Thrift servers receive messages containing containers of fields of unknown type; such messages are not error-checked, allowing malicious clients to send short messages that the server must parse...

CVE-2019-3559

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thri...

CVE-2019-3564

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift...

CVE-2019-3552

C++ Facebook Thrift servers using cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects...

CVE-2019-3558

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook...

CVE-2019-3565

Legacy C++ Facebook Thrift servers using cpp instead of cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service...

CVE-2019-3558: Excessive Iteration

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook...

PT-2019-16607

Name of the Vulnerable Software and Affected Versions Facebook Thrift versions prior to 2019.02.18.00 Description The issue allows malicious clients to send short messages that take a long time for the server to parse, potentially leading to denial of service. This occurs because Python Facebook...

PT-2019-16614

Name of the Vulnerable Software and Affected Versions Facebook Thrift versions prior to 2019.05.06.00 Description The issue arises when Legacy C++ Facebook Thrift servers, using cpp instead of cpp2, fail to error upon receiving messages containing containers of fields of unknown type. This allows...

PT-2019-16608

Name of the Vulnerable Software and Affected Versions Facebook Thrift versions prior to 2019.02.18.00 Description The issue allows malicious clients to send short messages that take a long time for the server to parse, potentially leading to denial of service. This occurs because Java Facebook...

PT-2019-16613

Name of the Vulnerable Software and Affected Versions Facebook Thrift versions prior to v2019.03.04.00 Description The issue allows malicious clients to send short messages with unknown fields that can take a long time for the server to parse, potentially leading to denial of service. This is...

CVE-2019-3552: Excessive Iteration

C++ Facebook Thrift servers using cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects...