An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload

C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload

Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type

C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type

A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects