{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119723", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "state": "PUBLISHED", "assignerShortName": "Meta", "dateReserved": "2026-10-30T15:01:18.704Z", "datePublished": "2026-11-11T16:57:01.125Z", "dateUpdated": "2026-11-11T16:57:01.125Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HHVM", "vendor": "Facebook", "versions": [{"lessThan": "23c061f4e804a51badd5f85227e65185651253b5", "status": "affected", "version": "0", "versionType": "git"}]}], "dateAssigned": "2026-10-30T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5."}], "problemTypes": [{"descriptions": [{"description": "Access of Resource Using Incompatible Type (CWE-843)", "lang": "en"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-11-11T16:57:01.125Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.facebook.com/security/advisories/cve-2026-119723"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HHVM", "vendor": "Facebook", "versions": [{"lessThan": "23c061f4e804a51badd5f85227e65185651253b5", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cve-assign@fb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5."}], "id": "CVE-2026-119723", "lastModified": "2026-11-11T17:17:17.220", "metrics": {}, "published": "2026-11-11T17:17:17.220", "references": [{"source": "cve-assign@fb.com", "url": "https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5"}, {"source": "cve-assign@fb.com", "url": "https://www.facebook.com/security/advisories/cve-2026-119723"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Received"}

{}

{}