CVE-2019-3564: Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Summary
CVE-2019-3564: Improper Input Validation and Excessive Iteration in Go Facebook Thrift. Affects github.com/facebook/fbthrift versions < 0.31.1-0.20190225164308-c461c1bd1a3e. Fixed in 0.31.1-0.20190225164308-c461c1bd1a3e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go Facebook Thrift is a framework for building scalable cross-language services. It allows developers to define data types and service interfaces in a simple definition language, which is then used to generate code for various programming languages. This vulnerability affects versions of Facebook Thrift prior to v2019.03.04.00. The vulnerability allows malicious clients to send messages with containers of fields of unknown type, causing the server to take a long time to parse these messages. This can lead to a denial of service (DoS) attack, as the server becomes unresponsive while processing these messages.
Vulnerability Detail
The vulnerability in Go Facebook Thrift arises from the server's failure to error upon receiving messages with containers of fields of unknown type. This allows malicious clients to send short messages that take a long time for the server to parse. As a result, the server becomes unresponsive and can be overwhelmed by a large number of these messages, leading to a denial of service (DoS) condition. The impact of this vulnerability is a disruption of service availability for legitimate users of the affected Go Facebook Thrift server.
How To Fix
Latest published version: v0.31.0 as of 23 Oct 2026
go get github.com/facebook/fbthrift@v0.31.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.1-0.20190225164308-c461c1bd1a3e
This is the first release that contains the fix.
go get github.com/facebook/fbthrift@v0.31.1-0.20190225164308-c461c1bd1a3eTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the patched version of Facebook Thrift to mitigate the risk of a DoS attack.
Conclusion
In conclusion, the vulnerability in Go Facebook Thrift allows malicious clients to send messages that can cause a denial of service (DoS) condition by overwhelming the server with containers of fields of unknown type. To mitigate this risk, it is important to upgrade to a version of Facebook Thrift that includes the fix for this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/facebook/fbthrift →
FAQ
Go Facebook Thrift is a framework for building scalable cross-language services. It allows developers to define data types and service interfaces in a simple definition language, which is then used to generate code for various programming languages.
The impact of this vulnerability is a disruption of service availability for legitimate users of the affected Go Facebook Thrift server. Malicious clients can send messages that cause the server to become unresponsive, leading to a denial of service (DoS) condition.
To fix this vulnerability, it is recommended to upgrade to a version of Facebook Thrift that is equal to or later than v2019.03.04.00. This version includes a fix for the improper input validation and excessive iteration issue.
There is no known workaround for this vulnerability. It is necessary to upgrade to the patched version of Facebook Thrift to mitigate the risk of a DoS attack.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-x4rg-4545-4w7w.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/facebook/fbthrift.
