CVE-2019-3554

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-19

Affected software

No affected versions have been published.

Timeline

Published: Jan 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-35568.1HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, CVE-2019-35579.8The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This beh CVE-2019-35587.5Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious cli CVE-2019-35597.5Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clien CVE-2019-35607.5An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on CVE-2019-35619.8Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported version CVE-2019-35626.1A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code CVE-2019-35639.8Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow CVE-2019-35647.5Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients CVE-2019-35657.5Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown CVE-2019-35665.9A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's acc CVE-2019-35678.1In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder