-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe patch shows critical modifications in readString() and readBinary() where length validation was moved to checkReadLength(). The removed code handled maxNetworkBytes validation incompletely (only after some conditions), while the added checkReadLength adds comprehensive validation. These functions directly process untrusted length values from the input stream, making them the entry points for malicious payloads that could trigger infinite loops or excessive memory allocation as described in CVE-2019-0205.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.thrift:libthrift | maven | <= 0.12.0 | 0.13.0 |