GHSA-w3r9-r9w7-8h48

Golang Facebook Thrift servers vulnerable to denial of service

Source: GitHub Advisory Database (reviewed) High CVE-2019-11939

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/facebook/fbthrift	< 0.31.1-0.20200311080807-483ed864d69f	0.31.1-0.20200311080807-483ed864d69f

Details

As written in the advisory (Markdown source, shown as plain text).

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00. ### Specific Go Packages Affected github.com/facebook/fbthrift/thrift/lib/go/thrift

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-11939 advisory
https://github.com/facebook/fbthrift/commit/483ed864d69f307e9e3b9dadec048216100c0757 web
https://github.com/facebook/fbthrift package
https://pkg.go.dev/vuln/GO-2021-0082 web
https://www.facebook.com/security/advisories/cve-2019-11939 web