TI-2019-02628 Aliases CVE-2019-3563 GHSA-r679-82m4-w988

Out-of-bounds write in Meta Wangle

MEDIUM 45CWE-126Published 2019-04-29 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow. This affects versions of Wangle prior to v2019.04.22.00

Why it matters now

EPSS 0.01709 77th percentileScored 2026-11-07

Fix Fixed Wangle (Facebook): v2019.04.22.00

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	Wangle	v2019.04.22.00; before v2019.04.22.00	v2019.04.22.00	Patch available	CNA

Wangle VendorMeta Affected v2019.04.22.00; before v2019.04.22.00 Fixed in v2019.04.22.00 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:facebook:wangle::::::::	before 2019.04.22.00	Vulnerable	Meta

cpe:2.3:a:facebook:wangle:*:*:*:*:*:*:*:* Versions before 2019.04.22.00 Vulnerable ·Meta

Remediation

Fix · CNA Wangle (Facebook) Fixed in v2019.04.22.00

Timeline

2026-10-02 Threatist record created from CVE-2019-3563
2026-10-03 Alias added: GHSA-r679-82m4-w988

References

Patch 1

https://github.com/facebook/wangle/commit/5b3bceca875e4ea4ed9d14c20b20ce46c92c13c6

TI-2019-02620 Uncontrolled resource consumption in Meta Wangle CVSS 3.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences