Denial of Service Vulnerability in HHVM from Facebook
CVE-2026-119723

Currently unrated

Key Information:

Vendor

Facebook

Status
Hhvm
Vendor
CVE Published:
11 November 2026

What is CVE-2026-119723?

A denial of service vulnerability exists in HHVM due to improper handling of nested arrays during the parsing of request variables. An attacker can exploit this flaw by sending specially crafted GET or POST requests that lead to a crash of the HHVM server process before any downstream application logic is executed. This exposes servers to downtime and potential service disruption. Versions of HHVM prior to the commit identified as 23c061f4e804a51badd5f85227e65185651253b5 are affected.

Affected Version(s)

HHVM 0 < 23c061f4e804a51badd5f85227e65185651253b5

References

https://www.facebook.com/security/advisories/cve-2026-119723
x_refsource_CONFIRM
https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f...
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.