cve/2019/CVE-2019-0210.md

### [CVE-2019-0210](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0210)
![](https://img.shields.io/static/v1?label=Product&message=Apache%20Thrift&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0.9.3%20to%200.12.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20read%20vulnerability&color=brightgreen)

### Description

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

### POC

#### Reference
- https://www.oracle.com//security-alerts/cpujul2021.html

#### Github
- https://github.com/Live-Hack-CVE/CVE-2019-0210
- https://github.com/k1LoW/oshka