HHVM · CVE-2026-119723 · Runtime
NO FIX YET · SEE WHAT TO DO
HHVM did not check whether appending a nested array succeeded while parsing query-string and form parameters. A remote, unauthenticated attacker can send one GET or POST request that crashes the HHVM server process before any application code runs.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any HHVM server that parses query-string or form parameters from untrusted clients is exposed, since the crash is triggered by a single request. Teams running PHP on other runtimes, or HHVM builds that include the fix commit, can skip it.
Not affected if not-running-hhvm, patched-build
Who cares hhvm, php, web-server
23c061f4e804a51badd5f85227e65185651253b523c061f4e804a51badd5f85227e65185651253b5When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.