CVE-2019-3564: facebook facebook thrift Excessive Iteration

EPSS trend

Probability

1.99%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

0.00 pp

From 1.99% on 20-09-2026

20-09-202620-10-2026

EPSS score

1.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

10 links

github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156X Refsource MISCREPORTFIXWEBPatchThird Party Advisory
www.facebook.com/security/advisories/cve-2019-3564X Refsource MISCREPORTAdvisoryWEBVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
ubuntu.com/security/CVE-2019-3564REPORT
github.com/apache/thrift/commit/dbc1f8def5018ce5d85d38b9875c6c6b6b424478REPORT
www.cve.org/CVERecord?id=CVE-2019-3564REPORT
nvd.nist.gov/vuln/detail/CVE-2019-3564Advisory
github.com/facebook/fbthriftPACKAGE
lists.apache.org/thread.html/…WEB
pkg.go.dev/vuln/GO-2021-0088WEB

Related vulnerabilities

CVE-2021-24028chainguardthrift+31.75%5y ago13-04-2021 23:20An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00.CVE-2024-45863facebookfacebook thrift0.35%2y ago27-09-2024 13:50A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00.CVE-2024-45773facebookfacebook thrift0.48%2y ago27-09-2024 13:49A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.CVE-2019-11939chainguardthrift+51.56%6y ago18-03-2020 00:40Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.CVE-2019-11938chainguardthrift+32.25%6y ago10-03-2020 20:30Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.CVE-2019-3559chainguardthrift+51.99%7y ago06-05-2019 15:15Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.

All vulnerabilities infacebook thrift thrift

CVE-2019-3564: facebook facebook thrift Excessive Iteration

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References