CVE-2019-3559
published 2019-05-06CVE-2019-3559: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.99%
78.4th percentile
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| facebook_thrift | — | — | |
| facebook_thrift | >= unspecified < v2019.02.18.00 | v2019.02.18.00 | |
| thrift | < 2019.02.18.00 | 2019.02.18.00 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6627-jcx5-j2g8: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
ghsa_unreviewed·2022-05-24
CVE-2019-3559 [HIGH] CWE-20 GHSA-6627-jcx5-j2g8: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
OSV
CVE-2019-3559: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
osv·2019-05-06·CVSS 7.5
CVE-2019-3559 [HIGH] CVE-2019-3559: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/facebook/fbthrift/commit/a56346ceacad28bf470017a6bda1d5518d0bd943https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttps://www.facebook.com/security/advisories/cve-2019-3559https://github.com/facebook/fbthrift/commit/a56346ceacad28bf470017a6bda1d5518d0bd943https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttps://www.facebook.com/security/advisories/cve-2019-3559
2019-05-06
Published