Dynamic Property Array Vulnerability in HHVM by Facebook

CVE-2020-1900

What is CVE-2020-1900?

This vulnerability in HHVM results from the failure to pre-reserve the full size of the dynamic property array during unserialization of objects with dynamic properties. When this pre-reservation does not occur, the array may resize unexpectedly, leading to the invalidation of previously stored references. Such behavior could potentially allow an attacker to exploit this flaw and manipulate application logic or exposure of sensitive data. Users are advised to update to versions that address this issue to ensure robust security.

References