CVE-2026-119723

Not enough EPSS history yet.

When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.

• github.comhttps://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5
• www.facebook.comhttps://www.facebook.com/security/advisories/cve-2026-119723

No related CVEs by CWE or product.