CVE-2019-11924

A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.

• CWE-770

• https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52fPatch, Third Party Advisory
• https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994bPatch, Third Party Advisory
• https://www.facebook.com/security/advisories/cve-2019-11924Vendor Advisory
• https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52fPatch, Third Party Advisory
• https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994bPatch, Third Party Advisory
• https://www.facebook.com/security/advisories/cve-2019-11924Vendor Advisory

Published

Aug 20, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1190An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2019-1191Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-1192A security feature bypass vulnerability exists when Microsof…4.3
• CVE-2019-11921An out of bounds write is possible via a specially crafted p…
• CVE-2019-11922A race condition in the one-pass compression functions of Zs…
• CVE-2019-11923In Mcrouter prior to v0.41.0, the deprecated ASCII parser wo…7.5
• CVE-2019-11925Insufficient boundary checks when processing the JPEG APP12 …
• CVE-2019-11926Insufficient boundary checks when processing M_SOFx markers …
• CVE-2019-11927An integer overflow in WhatsApp media parsing libraries allo…7.8
• CVE-2019-11928An input validation issue in WhatsApp Desktop versions prior…6.1
• CVE-2019-11929Insufficient boundary checks when formatting numbers in numb…9.8
• CVE-2019-1193A remote code execution vulnerability exists in the way that…6.4