CVE-2019-3553 Denial of service in Facebook Thrift

High 7.5 Published 10 Mar 2020 Updated 4 Aug 2024

Malicious clients can cause denial of service in C++ Facebook Thrift servers by sending messages with oversized container declarations, triggering excessive memory allocation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-3553?

CVE-2019-3553 is a high-severity denial of service vulnerability in Facebook Thrift, published on 10 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.

Weakness: CWE-770

Which versions are affected by CVE-2019-3553?

It affects 1 product.

Products include Facebook Thrift.

How do I fix CVE-2019-3553?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-3553 being exploited?

There is no known exploitation of CVE-2019-3553 in the wild and no public exploit code.

Sources

Also known as GHSA-859v-9mcv-7rw3.