CVE-2019-3564
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
- Record
CVE-2019-3564- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-834, CWE-755
- Updated
- 2026-11-02
CVE List No score
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
- Record
CVE-2019-3564- Weakness
- CWE-834
- Updated
- 2026-11-02
EUVDEUVD-2022-1246 No score
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
- Record
EUVD-2022-1246- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x4rg-4545-4w7w
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
- Record
GHSA-x4rg-4545-4w7w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-755, CWE-834
- Updated
- 2026-11-02
OSV
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
- Record
CVE-2019-3564- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-x4rg-4545-4w7w
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
- Record
GHSA-x4rg-4545-4w7w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-755, CWE-834
- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2019-3564
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
- Record
UBUNTU-CVE-2019-3564- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1773965922 No score
TuxCare security update for org.apache.thrift (5 CVEs)
TuxCare rebuilt 2 org.apache.thrift packages to address 5 CVEs. Fixed in 0.9.1-tuxcare.3.
- Record
CLSA-2026-1773965922- Updated
- 2026-11-02
OSVCLSA-2026-1773965924 No score
TuxCare security update for org.apache.thrift (4 CVEs)
TuxCare rebuilt 2 org.apache.thrift packages to address 4 CVEs. Fixed in 0.9.3-tuxcare.3.
- Record
CLSA-2026-1773965924- Updated
- 2026-11-02
OSVGO-2021-0088 No score
Denial of service via ignored unknown fields in github.com/facebook/fbthrift
Skip ignores unknown fields, rather than failing. A malicious user can craft small messages with unknown fields which can take significant resources to parse. If a server accepts messages from an untrusted user, it may be used as a denial of service vector.
- Record
GO-2021-0088- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/facebook/fbthriftGo |
before 0.31.1-0.20190225164308-c461c1bd1a3e | 0.31.1-0.20190225164308-c461c1bd1a3e |
org.apache.thrift:libfb303TuxCare:Maven From an advisory covering 5 CVEs |
0.9.1 up to 0.9.1-tuxcare.3, plus listed versions 0.9.1-tuxcare.10.9.1-tuxcare.2 |
0.9.1-tuxcare.3 |
org.apache.thrift:libthriftTuxCare:Maven From an advisory covering 5 CVEs |
0.9.1 up to 0.9.1-tuxcare.3, plus listed versions 0.9.1-tuxcare.10.9.1-tuxcare.2 |
0.9.1-tuxcare.3 |
org.apache.thrift:libfb303TuxCare:Maven From an advisory covering 4 CVEs |
0.9.3 up to 0.9.3-tuxcare.3, plus listed versions 0.9.3-tuxcare.20.9.3.tuxcare.1 |
0.9.3-tuxcare.3 |
org.apache.thrift:libthriftTuxCare:Maven From an advisory covering 4 CVEs |
0.9.3 up to 0.9.3-tuxcare.3, plus listed versions 0.9.3-tuxcare.20.9.3.tuxcare.1 |
0.9.3-tuxcare.3 |
golang-github-uber-go-tallyUbuntu:22.04:LTS |
All versions, plus listed versions 4.0.1-1 |
None known |
golang-github-uber-go-tallyUbuntu:24.04:LTS |
All versions, plus listed versions 4.1.7-24.1.10-14.1.11-1 |
None known |
golang-github-uber-go-tallyUbuntu:25.10 |
All versions, plus listed versions 4.1.16-1 |
None known |
golang-github-uber-go-tallyUbuntu:26.10 |
All versions, plus listed versions 4.1.17-14.1.17-2 |
None known |
golang-github-uber-go-tallyUbuntu:26.04:LTS |
All versions, plus listed versions 4.1.16-14.1.17-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3564 is a high vulnerability (CVSS 7.5) in Facebook Thrift, published May 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in github.com/facebook/fbthrift 0.31.1-0.20190225164308-c461c1bd1a3e.
References
github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156
facebook.com/security/advisories/cve-2019-3564
lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2019-3564
pkg.go.dev/vuln/GO-2021-0088