CVE-2019-11938 Denial of service in Facebook Thrift

High 7.5 Published 10 Mar 2020 Updated 4 Aug 2024

Malicious clients can cause excessive memory allocation in Java Facebook Thrift servers, leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-11938?

CVE-2019-11938 is a high-severity denial of service vulnerability in Facebook Thrift, published on 10 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.

Weakness: CWE-770

Which versions are affected by CVE-2019-11938?

It affects 1 product.

Products include Facebook Thrift.

How do I fix CVE-2019-11938?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-11938 being exploited?

There is no known exploitation of CVE-2019-11938 in the wild and no public exploit code.

Sources

Also known as GHSA-hr4p-8hm2-w85x.