CVE-2019-11937

HIGH

facebook/mcrouter < 0.41.0 - Denial of Service via Carbon Protocol Struct Input

Title source: llm

In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service.

Core 3

Core References

Release Notes, Vendor Advisory x_refsource_misc

Vendor Advisory x_refsource_confirm

Patch, Vendor Advisory x_refsource_misc

CVSS v3 7.5

EPSS 0.0143

EPSS Percentile 69.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674

Status published

Products (1)

facebook/mcrouter < 0.41.0

Published Dec 04, 2019

Tracked Since Feb 18, 2026