CVE-2026-119723

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119723", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "state": "PUBLISHED", "assignerShortName": "Meta", "dateReserved": "2026-10-30T15:01:18.704Z", "datePublished": "2026-11-11T16:57:01.125Z", "dateUpdated": "2026-11-11T16:57:01.125Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HHVM", "vendor": "Facebook", "versions": [{"lessThan": "23c061f4e804a51badd5f85227e65185651253b5", "status": "affected", "version": "0", "versionType": "git"}]}], "dateAssigned": "2026-10-30T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5."}], "problemTypes": [{"descriptions": [{"description": "Access of Resource Using Incompatible Type (CWE-843)", "lang": "en"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-11-11T16:57:01.125Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.facebook.com/security/advisories/cve-2026-119723"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HHVM", "vendor": "Facebook", "versions": [{"lessThan": "23c061f4e804a51badd5f85227e65185651253b5", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cve-assign@fb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5."}], "id": "CVE-2026-119723", "lastModified": "2026-11-12T20:04:52.377", "metrics": {}, "published": "2026-11-11T17:17:17.220", "references": [{"source": "cve-assign@fb.com", "url": "https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5"}, {"source": "cve-assign@fb.com", "url": "https://www.facebook.com/security/advisories/cve-2026-119723"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Awaiting Analysis"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,23c061f4e804a51badd5f85227e65185651253b5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "HHVM", "source": "cna", "vendor": "Facebook"}, "product": "hhvm", "vendor": "facebook"}], "created": "2026-11-12T11:30:01.900527+00:00", "updated": "2026-11-13T08:15:09.376336+00:00", "vendors": ["facebook", "facebook$PRODUCT$hhvm"]}