{"id":"CVE-2026-119723","kind":"vulnerability","aliases":["CVE-2026-119723"],"related":[],"title":"HHVM: crafted GET or POST request crashes the server process","description":"When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.","summary":"HHVM did not check whether appending a nested array succeeded while parsing query-string and form parameters. A remote, unauthenticated attacker can send one GET or POST request that crashes the HHVM server process before any application code runs.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HHVM","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["hhvm","php","runtime","web-server"],"not_affected_if":["not-running-hhvm","patched-build"],"how_to_check":"- Confirm whether the HHVM build in use predates commit `23c061f4e804a51badd5f85227e65185651253b5`\n- Check which HHVM version is deployed on servers that accept HTTP traffic","fix":"- HHVM: move to a build that includes commit `23c061f4e804a51badd5f85227e65185651253b5`","status":"open","published_at":"2026-11-11T17:17:17+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","triaged_at":"2026-11-11T17:29:07+00:00","updated_at":"2026-11-11T17:29:07+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T17:29:07Z","model":"claude-haiku-5-5","output":{"fix":"- HHVM: move to a build that includes commit `23c061f4e804a51badd5f85227e65185651253b5`","reach":"internet","title":"HHVM: crafted GET or POST request crashes the server process","impact":"medium","summary":"HHVM did not check whether appending a nested array succeeded while parsing query-string and form parameters. A remote, unauthenticated attacker can send one GET or POST request that crashes the HHVM server process before any application code runs.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["hhvm","php","web-server"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote request crashes the server process: denial of service","analyst_note":"","how_to_check":"- Confirm whether the HHVM build in use predates commit `23c061f4e804a51badd5f85227e65185651253b5`\n- Check which HHVM version is deployed on servers that accept HTTP traffic","plain_action":"","product_name":"HHVM","needs_analyst":false,"not_affected_if":["not-running-hhvm","patched-build"],"who_is_affected":"Any HHVM server that parses query-string or form parameters from untrusted clients is exposed, since the crash is triggered by a single request. Teams running PHP on other runtimes, or HHVM builds that include the fix commit, can skip it.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001202,"input_tokens":4576,"output_tokens":1488,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119723':13A,16A '-2026':12A,15A '23c061f4e804a51badd5f85227e65185651253b5':124C 'affect':120C 'append':29B,81C 'applic':61B,110C 'array':32B,84C 'attack':45B,93C 'check':27B,79C 'code':62B,111C 'could':94C 'craft':2A 'crash':7A,54B,103C 'cve':11A,14A 'denial':115C 'descend':87C 'form':40B,74C 'get':3A,49B,97C 'hhvm':1A,17A,18B,24B,56B,76C,105C,121C 'issu':119C 'lead':113C 'nest':31B,83C 'one':48B 'paramet':41B,75C 'pars':35B,65C 'php':19B 'post':5A,51B,99C 'prior':122C 'process':10A,58B,107C 'queri':37B,71C 'query-str':36B,70C 'remot':43B,91C 'request':6A,52B,66C,100C 'run':63B,112C 'runtim':20B 'send':47B,95C 'server':9A,23B,57B,106C 'servic':117C 'string':38B,72C 'succeed':33B,85C 'unauthent':44B,92C 'variabl':67C 'web':22B 'web-serv':21B 'whether':28B 'would':102C","nicknames":[],"mitigations":[],"who_affected":"Any HHVM server that parses query-string or form parameters from untrusted clients is exposed, since the crash is triggered by a single request. Teams running PHP on other runtimes, or HHVM builds that include the fix commit, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["hhvm"],"ptokens":["hhvm"],"labels":["hhvm","high","php","runtime","webserver"],"campaign_type":null,"search_a":"'-119723':13A,16A '-2026':12A,15A 'craft':2A 'crash':7A 'cve':11A,14A 'get':3A 'hhvm':1A,17A 'post':5A 'process':10A 'request':6A 'server':9A","search_b":"'append':29B 'applic':61B 'array':32B 'attack':45B 'check':27B 'code':62B 'crash':54B 'form':40B 'get':49B 'hhvm':18B,24B,56B 'nest':31B 'one':48B 'paramet':41B 'pars':35B 'php':19B 'post':51B 'process':58B 'queri':37B 'query-str':36B 'remot':43B 'request':52B 'run':63B 'runtim':20B 'send':47B 'server':23B,57B 'string':38B 'succeed':33B 'unauthent':44B 'web':22B 'web-serv':21B 'whether':28B","search_c":"'23c061f4e804a51badd5f85227e65185651253b5':124C 'affect':120C 'append':81C 'applic':110C 'array':84C 'attack':93C 'check':79C 'code':111C 'could':94C 'crash':103C 'denial':115C 'descend':87C 'form':74C 'get':97C 'hhvm':76C,105C,121C 'issu':119C 'lead':113C 'nest':83C 'paramet':75C 'pars':65C 'post':99C 'prior':122C 'process':107C 'queri':71C 'query-str':70C 'remot':91C 'request':66C,100C 'run':112C 'send':95C 'server':106C 'servic':117C 'string':72C 'succeed':85C 'unauthent':92C 'variabl':67C 'would':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119723","severity":null,"published_at":"2026-11-11T17:17:17+00:00","modified_at":"2026-11-11T17:17:17+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","fetched_at":"2026-11-11T17:28:21+00:00","note":null}],"documents":[{"id":127302,"url":"https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}