GitHub Advisoryadvisory · Maven

GHSA-g2fg-mr77-6vrm Uncontrolled Resource Consumption in Apache Thrift

HIGH Published 2021-03-12 Modified 2022-02-08 Official page ↗
Aliases
CVE-2020-13949
Ecosystem
Maven
Packages
org.apache.thrift:libthrift
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-03-12

Affected packages

• Maven org.apache.thrift:libthrift: >= 0.9.3, < 0.14.0 → fixed in 0.14.0

Description

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Related

Alias · CVE (1)

  • CVE-2020-13949 In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation,… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References