CVE-2019-11937

Summary: CVE-2019-11937 affects Mcrouter prior to v0.41.0. A large struct input in the Carbon protocol reader can cause stack exhaustion leading to denial of service. Affected component: Mcrouter, Carbon protocol reader. Cause: Unbounded/large struct input processing in the Carbon protocol reader...

CVE-2019-11923

CVE-2019-11923 affects Mcrouter prior to v0.41.0. The deprecated ASCII parser could allocate a buffer to a user-specified length with no maximum, enabling resource exhaustion and denial of service. The Red Hat advisory corroborates the same description. Practical impact is DoS via unbounded alloc...