CVE-2019-11939

CVE-2019-11939 affects Golang Facebook Thrift servers. The vulnerability arises when servers preallocate memory for the declared message size without verifying actual size, allowing a malicious client to trigger large memory allocations and cause a denial of service. It impacts Facebook Thrift pr...

CVE-2019-11938

CVE-2019-11938 involves Java Facebook Thrift servers that fail to error when receiving messages declaring containers larger than the payload. This allows a malicious client sending a short message to trigger a large memory allocation, potentially causing a denial of service. Affected product is F...

CVE-2019-3553

The CVE-2019-3553 issue affects C++ Facebook Thrift servers security handling where messages declaring container sizes larger than the payload bypass error checks, enabling a malicious client to trigger large memory allocations and potentially cause a denial of service. The vulnerability is assoc...

CVE-2021-24028

CVE-2021-24028 : A flaw in Facebook Thrift’s table-based serialization causes an invalid free, which can crash the application and potentially allow code execution. Affected software is Facebook Thrift prior to v2021.02.22.00. Remediation: upgrade to v2021.02.22.00 or newer. Note: exploitation de...

CVE-2019-3558

CVE-2019-3558 affects the Facebook Thrift server implementation. The issue arises when Python Facebook Thrift servers receive messages containing containers of fields of unknown type; such messages are not error-checked, allowing malicious clients to send short messages that the server must parse...

CVE-2019-3552

CVE-2019-3552 affects Facebook Thrift servers (cpp2). The issue occurs when the server accepts messages containing containers with fields of unknown type, which can cause the server to parse lengthy requests and permit denial of service. Public documents consistently state that this affects Thrif...

CVE-2019-3564

CVE-2019-3564 affects Go Facebook Thrift servers where messages containing containers with fields of unknown type are not rejected. This can allow a malicious client to send short messages that take long to parse, enabling a denial-of-service condition. Affected product: Facebook Thrift (Go imple...

CVE-2019-3565

Summary: CVE-2019-3565 affects legacy Facebook Thrift servers (cpp, not cpp2). The root cause is that servers would not error when receiving messages containing containers of fields with unknown types, enabling malicious clients to send short messages that force long parsing times and cause denia...

CVE-2019-3559

The CVE-2019-3559 issue affects Facebook Thrift servers prior to v2019.02.18.00. The root cause is that Java Facebook Thrift servers would not error when receiving messages whose containers contain fields of unknown type, allowing malicious clients to craft short messages that take a long time to...