CVE-2019-11938

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.

• CWE-770
• CWE-770

• https://github.com/facebook/fbthrift/commit/08c2d412adb214c40bb03be7587057b25d053030Patch, Third Party Advisory
• https://github.com/facebook/fbthrift/commit/71c97ffdcb61cccf1f8267774e873e21ebd3ebd3Patch, Third Party Advisory
• https://www.facebook.com/security/advisories/cve-2019-11938Vendor Advisory
• https://github.com/facebook/fbthrift/commit/08c2d412adb214c40bb03be7587057b25d053030Patch, Third Party Advisory
• https://github.com/facebook/fbthrift/commit/71c97ffdcb61cccf1f8267774e873e21ebd3ebd3Patch, Third Party Advisory
• https://www.facebook.com/security/advisories/cve-2019-11938Vendor Advisory

Published

Mar 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11932A double free vulnerability in the DDGifSlurp function in de…8.8
• CVE-2019-11933A heap buffer overflow bug in libpl_droidsonroids_gif before…9.8
• CVE-2019-11934Improper handling of close_notify alerts can result in an ou…9.8
• CVE-2019-11935Insufficient boundary checks when processing a string in mb_…9.8
• CVE-2019-11936Various APC functions accept keys containing null bytes as i…9.8
• CVE-2019-11937In Mcrouter prior to v0.41.0, a large struct input provided …7.5
• CVE-2019-11939Golang Facebook Thrift servers would not error upon receivin…7.5
• CVE-2019-1194A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-11940In the course of decompressing HPACK inside the HTTP2 protoc…9.8
• CVE-2019-11941A remote code execution vulnerability was identified in HPE …
• CVE-2019-11942A remote code execution vulnerability was identified in HPE …
• CVE-2019-11943A remote code execution vulnerability was identified in HPE …