Uncontrolled Deserialization Vulnerability in HHVM by Facebook

CVE-2020-1898

What is CVE-2020-1898?

The fb_unserialize function in HHVM lacks a depth limit for nested deserialization, allowing an attacker to craft a malicious input that can lead to excessive recursion. This uncontrolled recursion may result in stack exhaustion, causing the application to crash or become unresponsive. Users of affected HHVM versions should update promptly to safeguard against exploitation.

References