CVE-2019-11939
CVE-2019-11939
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.
CVSS 7.5 · High · EPSS 1.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
facebook thrift
- Versions
- ≥ v2020.03.16.00, < unspecified: Not affected (custom)
- ≥ unspecified, < v2020.03.16.00: Affected (custom)
Update to v2020.03.16.00
thrift Ubuntu:20.04:LTS
- Versions
- 0.11.0-6
- 0.13.0-2build1
- 0.13.0-2build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Ubuntu:22.04:LTS
- Versions
- 0.13.0-6ubuntu1
- 0.13.0-6ubuntu2
- 0.13.0-6ubuntu3
- 0.13.0-7
- 0.16.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Ubuntu:24.04:LTS
- Versions
- 0.17.0-4
- 0.19.0-2
- 0.19.0-2build1
- 0.19.0-2.1build4
- 0.19.0-2.1build5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Ubuntu:25.10
- Versions
- 0.19.0-4build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Ubuntu:26.10
- Versions
- 0.22.0-3ubuntu1
- 0.23.0-3
- 0.23.0-3ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Ubuntu:26.04:LTS
- Versions
- 0.19.0-4build1
- 0.22.0-3
- 0.22.0-3ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published