CVE-2019-11939: Golang Facebook Thrift servers vulnerable to denial of service
Summary
CVE-2019-11939: Golang Facebook Thrift servers vulnerable to denial of service. Affects github.com/facebook/fbthrift versions < 0.31.1-0.20200311080807-483ed864d69f. Fixed in 0.31.1-0.20200311080807-483ed864d69f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Golang Facebook Thrift servers are a set of libraries and tools for building efficient and scalable RPC (Remote Procedure Call) services. These servers are widely used in various applications to enable communication between different components. The servers handle incoming messages and process them according to the defined Thrift protocol. However, prior to version v2020.03.16.00, the servers did not properly handle messages declaring containers of sizes larger than the payload. This vulnerability could be exploited by malicious clients to send short messages that would result in a large memory allocation, potentially leading to denial of service attacks.
Vulnerability Detail
The vulnerability in Golang Facebook Thrift servers allows malicious clients to exploit the servers' failure to error upon receiving messages with containers of larger sizes than the payload. By sending short messages that trigger large memory allocations, attackers can cause the servers to consume excessive resources, potentially leading to denial of service. This vulnerability has a CVSS score of 7.5, indicating a high severity level. It affects Facebook Thrift versions prior to v2020.03.16.00.
How To Fix
Latest published version: v0.31.0 as of 23 Oct 2026
go get github.com/facebook/fbthrift@v0.31.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.1-0.20200311080807-483ed864d69f
This is the first release that contains the fix.
go get github.com/facebook/fbthrift@v0.31.1-0.20200311080807-483ed864d69fTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Facebook Thrift library to the fixed version to mitigate the risk of denial of service attacks.
Conclusion
The Golang Facebook Thrift servers are vulnerable to denial of service attacks due to a failure to properly handle messages with containers of larger sizes than the payload. To mitigate this vulnerability, it is crucial to update the Facebook Thrift library to version v2020.03.16.00 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/facebook/fbthrift →
FAQ
Golang Facebook Thrift is a set of libraries and tools for building efficient and scalable RPC services. It enables communication between different components in applications.
The vulnerability allows malicious clients to cause denial of service attacks by sending short messages that trigger large memory allocations in the Facebook Thrift servers.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, update the Facebook Thrift library to version v2020.03.16.00 or later.
There is no known workaround for this vulnerability. Updating the Facebook Thrift library is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/facebook/fbthrift.
