CVE-2019-11939: Denial of Service in github.com/facebook/fbthrift
Summary
CVE-2019-11939: Denial of service via malicious message size declaration in github.com/facebook/fbthrift. Affects github.com/facebook/fbthrift versions < 0.31.1-0.20200311080807-483ed864d69f. Fixed in 0.31.1-0.20200311080807-483ed864d69f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/facebook/fbthrift, which is a Go implementation of Apache Thrift, a framework for scalable cross-language services development. fbthrift provides a set of libraries and tools for building efficient and reliable communication protocols. It is widely used in various applications for inter-service communication. However, a vulnerability has been identified in fbthrift that can lead to a denial of service attack.
Vulnerability Detail
The vulnerability (CVE-2019-11939) in fbthrift arises from the fact that Thrift Servers preallocate memory for the declared size of messages before checking the actual size of the message. This design flaw allows a malicious user to send messages that declare they are significantly larger than they actually are, tricking the server into allocating excessive amounts of memory. As a result, the server becomes overwhelmed and may crash, leading to a denial of service. This vulnerability can be exploited remotely and poses a significant risk to applications utilizing fbthrift.
How To Fix
Latest published version: v0.31.0 as of 23 Oct 2026
go get github.com/facebook/fbthrift@v0.31.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.1-0.20200311080807-483ed864d69f
This is the first release that contains the fix.
go get github.com/facebook/fbthrift@v0.31.1-0.20200311080807-483ed864d69fTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of fbthrift to mitigate the risk of a denial of service attack.
Conclusion
The vulnerability (CVE-2019-11939) in github.com/facebook/fbthrift allows an attacker to perform a denial of service attack by tricking the server into allocating excessive amounts of memory. To mitigate this risk, it is crucial to update the fbthrift package to version 0.31.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/facebook/fbthrift →
FAQ
fbthrift is a Go implementation of Apache Thrift, a framework for scalable cross-language services development.
The vulnerability allows an attacker to perform a denial of service attack, potentially crashing the server and disrupting the application's functionality.
To fix this vulnerability, update the fbthrift package to version 0.31.1 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Yes, this vulnerability can be exploited remotely, making it a significant security risk for applications using fbthrift.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/facebook/fbthrift.
