Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2019-11923

Summary
Assigner-facebook
Assigner Org ID-4fc57720-52fe-4431-a0fb-3d2c8747b827
Published At-04 Dec, 2019 | 16:00
Updated At-04 Aug, 2024 | 23:10
Rejected At-
Credits

In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:facebook
Assigner Org ID:4fc57720-52fe-4431-a0fb-3d2c8747b827
Published At:04 Dec, 2019 | 16:00
Updated At:04 Aug, 2024 | 23:10
Rejected At:
▼CVE Numbering Authority (CNA)

In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.

Affected Products
Vendor
FacebookFacebook
Product
Mcrouter
Versions
Affected
  • 0.41.0
  • From unspecified before 0.41.0 (custom)
Problem Types
TypeCWE IDDescription
textN/AAllocation of Resources Without Limits or Throttling (CWE-ID 770)
Type: text
CWE ID: N/A
Description: Allocation of Resources Without Limits or Throttling (CWE-ID 770)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.facebook.com/security/advisories/cve-2019-11923
x_refsource_CONFIRM
https://github.com/facebook/mcrouter/releases/tag/v0.41.0-release
x_refsource_MISC
https://github.com/facebook/mcrouter/commit/98ce6624cd2563cfdb5da3b2949d5e1e03867034
x_refsource_MISC
Hyperlink: https://www.facebook.com/security/advisories/cve-2019-11923
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/facebook/mcrouter/releases/tag/v0.41.0-release
Resource:
x_refsource_MISC
Hyperlink: https://github.com/facebook/mcrouter/commit/98ce6624cd2563cfdb5da3b2949d5e1e03867034
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.facebook.com/security/advisories/cve-2019-11923
x_refsource_CONFIRM
x_transferred
https://github.com/facebook/mcrouter/releases/tag/v0.41.0-release
x_refsource_MISC
x_transferred
https://github.com/facebook/mcrouter/commit/98ce6624cd2563cfdb5da3b2949d5e1e03867034
x_refsource_MISC
x_transferred
Hyperlink: https://www.facebook.com/security/advisories/cve-2019-11923
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: https://github.com/facebook/mcrouter/releases/tag/v0.41.0-release
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://github.com/facebook/mcrouter/commit/98ce6624cd2563cfdb5da3b2949d5e1e03867034
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cve-assign@fb.com
Published At:04 Dec, 2019 | 16:15
Updated At:24 Aug, 2020 | 17:37

In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary2.05.0MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
Type: Primary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Type: Primary
Version: 2.0
Base score: 5.0
Base severity: MEDIUM
Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
CPE Matches

Facebook
facebook
>>mcrouter>>Versions before 0.41.0(exclusive)
cpe:2.3:a:facebook:mcrouter:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-770Primarynvd@nist.gov
CWE ID: CWE-770
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/facebook/mcrouter/commit/98ce6624cd2563cfdb5da3b2949d5e1e03867034cve-assign@fb.com
Patch
Third Party Advisory
https://github.com/facebook/mcrouter/releases/tag/v0.41.0-releasecve-assign@fb.com
Release Notes
Vendor Advisory
https://www.facebook.com/security/advisories/cve-2019-11923cve-assign@fb.com
Vendor Advisory
Hyperlink: https://github.com/facebook/mcrouter/commit/98ce6624cd2563cfdb5da3b2949d5e1e03867034
Source: cve-assign@fb.com
Resource:
Patch
Third Party Advisory
Hyperlink: https://github.com/facebook/mcrouter/releases/tag/v0.41.0-release
Source: cve-assign@fb.com
Resource:
Release Notes
Vendor Advisory
Hyperlink: https://www.facebook.com/security/advisories/cve-2019-11923
Source: cve-assign@fb.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

655Records found

CVE-2021-47876
Matching Score-4
Assigner-VulnCheck
ShareView Details
Matching Score-4
Assigner-VulnCheck
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 10.93%
||
7 Day CHG~0.00%
Published-21 Jan, 2026 | 17:27
Updated-26 Jan, 2026 | 15:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
GeoGebra Classic 5.0.631.0-d - Denial of Service

GeoGebra Classic 5.0.631.0-d contains a denial of service vulnerability in the input field that allows attackers to crash the application by sending oversized buffer content. Attackers can generate a large buffer of 800,000 repeated characters and paste it into the 'Entrada:' input field to trigger an application crash.

Action-Not Available
Vendor-GeoGebra
Product-GeoGebra Classic
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2021-47894
Matching Score-4
Assigner-VulnCheck
ShareView Details
Matching Score-4
Assigner-VulnCheck
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 10.77%
||
7 Day CHG~0.00%
Published-23 Jan, 2026 | 16:47
Updated-26 Jan, 2026 | 15:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Managed Switch Port Mapping Tool 2.85.2 - Denial of Service

Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buffer. Attackers can generate a 10,000-character buffer and paste it into the IP Address and SNMP Community Name fields to trigger the application crash.

Action-Not Available
Vendor-Northwest Performance Software, Inc.
Product-Managed Switch Port Mapping Tool
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2021-46877
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.26% / 49.19%
||
7 Day CHG~0.00%
Published-18 Mar, 2023 | 00:00
Updated-26 Feb, 2025 | 19:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Action-Not Available
Vendor-n/aFasterXML, LLC.
Product-jackson-databindn/a
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2018-15383
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-7.5||HIGH
EPSS-0.94% / 75.87%
||
7 Day CHG~0.00%
Published-05 Oct, 2018 | 14:00
Updated-26 Nov, 2024 | 14:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco Adaptive Security Appliance Direct Memory Access Denial of Service Vulnerability

A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An attacker could exploit this vulnerability by sending a sustained, high rate of malicious traffic to an affected device to exhaust memory on the device. A successful exploit could allow the attacker to exhaust DMA memory on the affected device, which could cause the device to reload and result in a temporary DoS condition.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-firepower_threat_defenseadaptive_security_appliance_softwareCisco Adaptive Security Appliance (ASA) Software
CWE ID-CWE-400
Uncontrolled Resource Consumption
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2021-41800
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.3||MEDIUM
EPSS-0.18% / 39.23%
||
7 Day CHG~0.00%
Published-11 Oct, 2021 | 00:00
Updated-04 Aug, 2024 | 03:22
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.

Action-Not Available
Vendor-n/aWikimedia FoundationFedora Project
Product-fedoramediawikin/a
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
  • Previous
  • 1
  • 2
  • ...
  • 12
  • 13
  • 14
  • Next
Details not found