CVE-2026-119723: Security vulnerability

Published Nov 11, 2026

Updated

When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.

Frequently Asked Questions

What systems are exposed to this denial-of-service issue?

HHVM deployments running a version or build prior to commit 23c061f4e804a51badd5f85227e65185651253b5 are affected if an attacker can send GET or POST requests to the HHVM server.

Does exploitation require authentication or application-specific endpoints?

No. The attacker is remote and unauthenticated, and the crash occurs while HHVM parses request variables before application code runs.

How can I determine whether my deployment is affected?

Check whether the HHVM version or source build includes commit 23c061f4e804a51badd5f85227e65185651253b5. Builds prior to that commit are affected.

CVE-2026-119723: Security vulnerability

Frequently Asked Questions

What systems are exposed to this denial-of-service issue?

Does exploitation require authentication or application-specific endpoints?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this denial-of-service issue?

Does exploitation require authentication or application-specific endpoints?

How can I determine whether my deployment is affected?