{"affected":[{"defaultStatus":"unaffected","product":"HHVM","source":"CNA: Meta","vendor":"Facebook","versions":[{"lessThan":"23c061f4e804a51badd5f85227e65185651253b5","status":"affected","version":"0","versionType":"git"}]}],"cveId":"CVE-2026-119723","cwes":["CWE-843"],"description":"When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794417437220,"publishedAt":1794416221125,"references":[{"source":"CNA: Meta","tags":["x_refsource_CONFIRM"],"url":"https://www.facebook.com/security/advisories/cve-2026-119723"},{"source":"CNA: Meta","tags":["x_refsource_MISC"],"url":"https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5"},{"source":"cve-assign@fb.com","tags":[],"url":"https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5"},{"source":"cve-assign@fb.com","tags":[],"url":"https://www.facebook.com/security/advisories/cve-2026-119723"}],"remediation":[],"revision":"020f0415a54716f2f0397659b23600290f633827700869586776b88a77fdc3bf","sources":[{"modifiedAt":1794416221125,"name":"CNA: Meta","retrievedAt":1794416911540,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119723"},{"modifiedAt":1794417437220,"name":"NVD","retrievedAt":1794421060699,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119723"}],"ssvc":null,"status":"published","title":"CVE-2026-119723","updatedAt":1794421060699}