CVE-2019-3564
published 2019-05-06CVE-2019-3564: Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.99%
78.5th percentile
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| facebook_thrift | — | — | |
| facebook_thrift | >= unspecified < v2019.03.04.00 | v2019.03.04.00 | |
| thrift | < 2019.03.04.00 | 2019.03.04.00 | |
| github.com | facebook_fbthrift | >= 0 < 0.31.1-0.20190225164308-c461c1bd1a3e | 0.31.1-0.20190225164308-c461c1bd1a3e |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
osv·2022-02-15
CVE-2019-3564 [HIGH] Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
GHSA
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
ghsa·2022-02-15
CVE-2019-3564 [HIGH] CWE-20 Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
OSV
Denial of service via ignored unknown fields in github.com/facebook/fbthrift
osv·2021-04-14
CVE-2019-3564 Denial of service via ignored unknown fields in github.com/facebook/fbthrift
Denial of service via ignored unknown fields in github.com/facebook/fbthrift
Skip ignores unknown fields, rather than failing. A malicious user can craft small messages with unknown fields which can take significant resources to parse. If a server accepts messages from an untrusted user, it may be used as a denial of service vector.
OSV
CVE-2019-3564: Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
osv·2019-05-06·CVSS 7.5
CVE-2019-3564 [HIGH] CVE-2019-3564: Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttps://www.facebook.com/security/advisories/cve-2019-3564https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttps://www.facebook.com/security/advisories/cve-2019-3564
2019-05-06
Published