CVE-2019-3553
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes...
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
- Record
CVE-2019-3553- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List No score
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
- Record
CVE-2019-3553- Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2019-13190 No score
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
- Record
EUVD-2019-13190- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-859v-9mcv-7rw3
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes...
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
- Record
GHSA-859v-9mcv-7rw3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
- Record
CVE-2019-3553- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVCLSA-2026-1773965922 No score
TuxCare security update for org.apache.thrift (5 CVEs)
TuxCare rebuilt 2 org.apache.thrift packages to address 5 CVEs. Fixed in 0.9.1-tuxcare.3.
- Record
CLSA-2026-1773965922- Updated
- 2026-11-02
OSVCLSA-2026-1773965924 No score
TuxCare security update for org.apache.thrift (4 CVEs)
TuxCare rebuilt 2 org.apache.thrift packages to address 4 CVEs. Fixed in 0.9.3-tuxcare.3.
- Record
CLSA-2026-1773965924- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.thrift:libfb303TuxCare:Maven From an advisory covering 5 CVEs |
0.9.1 up to 0.9.1-tuxcare.3, plus listed versions 0.9.1-tuxcare.10.9.1-tuxcare.2 |
0.9.1-tuxcare.3 |
org.apache.thrift:libthriftTuxCare:Maven From an advisory covering 5 CVEs |
0.9.1 up to 0.9.1-tuxcare.3, plus listed versions 0.9.1-tuxcare.10.9.1-tuxcare.2 |
0.9.1-tuxcare.3 |
org.apache.thrift:libfb303TuxCare:Maven From an advisory covering 4 CVEs |
0.9.3 up to 0.9.3-tuxcare.3, plus listed versions 0.9.3-tuxcare.20.9.3.tuxcare.1 |
0.9.3-tuxcare.3 |
org.apache.thrift:libthriftTuxCare:Maven From an advisory covering 4 CVEs |
0.9.3 up to 0.9.3-tuxcare.3, plus listed versions 0.9.3-tuxcare.20.9.3.tuxcare.1 |
0.9.3-tuxcare.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3553 is a high vulnerability (CVSS 7.5) in Facebook Thrift, published March 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. No source names a fixed version.