What’s Vulnerable › Vulnerabilities

CVE-2019-3560

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-29 · updated 2026-06-17
• Weakness: CWE-835

Description

An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on user input. This issue affected versions of fizz prior to v2019.03.04.00.

Affected products

• Facebook fizz: before 2019.03.04.00 — fixed in 2019.03.04.00

How to fix

Upgrade to a fixed version: Facebook fizz 2019.03.04.00. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html
• http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html
• https://github.com/facebookincubator/fizz/commit/40bbb161e72fb609608d53b9d64c56bb961a6ee2
• http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html
• http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html
• https://github.com/facebookincubator/fizz/commit/40bbb161e72fb609608d53b9d64c56bb961a6ee2

Get alerted when CVE-2019-3560 or the next vulnerability affects your stack