GitHub Advisoryadvisory · Go

GHSA-w3r9-r9w7-8h48 Golang Facebook Thrift servers vulnerable to denial of service

HIGH Published 2022-05-24 Modified 2023-09-29 Official page ↗
Aliases
CVE-2019-11939
Ecosystem
Go
Packages
github.com/facebook/fbthrift
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2023-02-08

Affected packages

• Go github.com/facebook/fbthrift: < 0.31.1-0.20200311080807-483ed864d69f → fixed in 0.31.1-0.20200311080807-483ed864d69f

Description

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00. Specific Go Packages Affected github.com/facebook/fbthrift/thrift/lib/go/thrift

Related

Alias · CVE (1)

  • CVE-2019-11939 Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References