CVE-2026-119723

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.

Vendor	facebook
Product	hhvm
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for facebook hhvm

Be the first to know when new unknown vulnerabilities affecting facebook hhvm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Facebook / HHVM

0 < 23c061f4e804a51badd5f85227e65185651253b5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

facebook.com: https://www.facebook.com/security/advisories/cve-2026-119723 github.com: https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5