CVE-2019-11940
Last modified
CVE-2019-11940 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.. EPSS estimates a 1.36% chance of exploitation in the next 30 days.
Description
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Proxygen | >= 0.29.0, <= 2017.04.03.00 |
References
- https://github.com/facebook/proxygen/commit/f43b134cc5c19d8532e7fb670a1c02e85f7a8d4fPatch, Third Party Advisory
- https://www.facebook.com/security/advisories/cve-2019-11940Third Party Advisory
- https://github.com/facebook/proxygen/commit/f43b134cc5c19d8532e7fb670a1c02e85f7a8d4fPatch, Third Party Advisory
- https://www.facebook.com/security/advisories/cve-2019-11940Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-11940?
How severe is CVE-2019-11940?
How do I fix CVE-2019-11940?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-11935Insufficient boundary checks when processing a string in mb_…9.8
- CVE-2019-11936Various APC functions accept keys containing null bytes as i…9.8
- CVE-2019-11937In Mcrouter prior to v0.41.0, a large struct input provided …7.5
- CVE-2019-11938Java Facebook Thrift servers would not error upon receiving …7.5
- CVE-2019-11939Golang Facebook Thrift servers would not error upon receivin…7.5
- CVE-2019-1194A remote code execution vulnerability exists in the way that…7.5
- CVE-2019-11941A remote code execution vulnerability was identified in HPE …
- CVE-2019-11942A remote code execution vulnerability was identified in HPE …
- CVE-2019-11943A remote code execution vulnerability was identified in HPE …
- CVE-2019-11944A remote code execution vulnerability was identified in HPE …
- CVE-2019-11945A remote code execution vulnerability was identified in HPE …
- CVE-2019-11946A remote credential disclosure vulnerability was identified …
Are you affected by CVE-2019-11940?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST