CVE-2019-3558

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-834 CWE-755

Affected software

Vendor	Product	Versions
Facebook	Facebook Thrift	v2019.02.18.00; >= unspecified, < v2019.02.18.00

References

http://www.securityfocus.com/bid/108274Broken Link
https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62bPatch, Third Party Advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
https://www.facebook.com/security/advisories/cve-2019-3558Vendor Advisory
http://www.securityfocus.com/bid/108274Broken Link
https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62bPatch, Third Party Advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
https://www.facebook.com/security/advisories/cve-2019-3558Vendor Advisory

Timeline

Published: May 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-35597.5Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clien CVE-2019-35607.5An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on CVE-2019-35619.8Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported version CVE-2019-35626.1A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code CVE-2019-35639.8Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow CVE-2019-35647.5Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients CVE-2019-35657.5Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown CVE-2019-35665.9A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's acc CVE-2019-35678.1In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder CVE-2019-35689.8A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a CVE-2019-35697.5HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended CVE-2019-35709.8Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if