Description
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://hhvm.com/blog/2020/06/30/security-update.html
Patch, Third Party Advisory x_refsource_misc
https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c
Scores
CVSS v3
7.5
EPSS
0.0083
EPSS Percentile
74.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-674
Status
published
Products (8)
facebook/hhvm
4.57.0
facebook/hhvm
4.58.0
facebook/hhvm
4.58.1
facebook/hhvm
4.59.0
facebook/hhvm
4.60.0
facebook/hhvm
4.61.0
facebook/hhvm
4.62.0
facebook/hhvm
< 4.32.3
Published
Mar 11, 2021
Tracked Since
Feb 18, 2026