CVE-2019-11924

Published: Aug 20, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.

Affected (1)

Products: Facebook: Fizz

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Fizz	From 2019.01.28.00 to 2019.08.05.00

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (6)

https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52f

Source: cve-assign@fb.com

PatchThird Party Advisory

https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994b

Source: cve-assign@fb.com

PatchThird Party Advisory

https://www.facebook.com/security/advisories/cve-2019-11924

Source: cve-assign@fb.com

Vendor Advisory

https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52f

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994b

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.facebook.com/security/advisories/cve-2019-11924

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.