VirtualTablet Server Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in VirtualTablet Server version 3.0.2. This issue allows attackers to crash the service by sending oversized string payloads through the Thrift protocol. Exploitation involves sending a long string to the send_say() method, which causes the server to become unresponsive.

Impact

Exploitation of this vulnerability leads to a crash of the VirtualTablet Server, causing it to become unresponsive.

Reproduction

The vulnerability can be reproduced by sending a long string payload through the Thrift protocol to the send_say() method. This can be done using a Thrift client that connects to the VirtualTablet Server.