CVE-2019-11924

State: Published
Severity: Not scored
Published: Aug 20, 2019
Updated: Aug 4, 2024
Reserved: May 13, 2019

Description

A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
fizzFacebook	v2019.08.12.00Affected v2019.01.28.00 to before unspecifiedAffected

References

https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994b
https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52f
https://www.facebook.com/security/advisories/cve-2019-11924

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.