Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2020-1898: HHVM allows malicious data to cause system crashes
CVE-2020-1898 · published 5 years ago
Summary
HHVM versions 4.32.3 to 4.62.0 are affected. An attacker could create a specially crafted string that crashes the server by causing it to run out of memory. Update to HHVM version 4.62.1 or later to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hhvm |
< 4.32.3 >= 4.33.0, < 4.56.1 4.57.0 4.58.0 4.58.1 4.59.0 4.60.0 4.61.0 4.62.0 cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* |
Original advisory text
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion....
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
References
- https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c Patch Third Party Advisory
- https://hhvm.com/blog/2020/06/30/security-update.html Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-674Uncontrolled Recursion
Timeline
Published11 Mar 2021
Updated4 Nov 2026
First seen11 Apr 2026
Track software like this
Free during beta