CVE-2019-11938: 
Apache Thrift vulnerability analysis and mitigation

Java Facebook Thrift servers were found to be vulnerable to memory exhaustion due to improper validation of container sizes in messages. The vulnerability, identified as CVE-2019-11938, allowed servers to process messages declaring containers of sizes larger than the actual payload without proper error handling (NVD).

The vulnerability existed in the Java implementation of Facebook's Thrift protocol where the servers would not properly validate the size of containers against the remaining frame size before deserialization. This could lead to over-allocation of memory when processing malformed or truncated frames. The fix involved implementing size validation checks in both TBinaryProtocol and TCompactProtocol implementations, ensuring that there is enough data in the current frame before attempting deserialization (Facebook Commit).

The vulnerability could lead to memory exhaustion in Java Facebook Thrift servers, potentially resulting in denial of service conditions when processing maliciously crafted messages (NVD).

The vulnerability was patched through commits that implemented proper size validation checks. The fix ensures that the server validates the remaining frame size before attempting to deserialize containers and strings (Facebook Commit).