{"id":"CVE-2016-6873","details":"Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.","modified":"2026-07-08T12:27:35.787484Z","published":"2017-02-17T17:59:01.077Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/08/11/1"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/08/19/1"},{"type":"FIX","url":"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/hhvm","events":[{"introduced":"0"},{"last_affected":"c6bf714e6468213eed377527b431e9cd4cec1432"},{"fixed":"e264f04ae825a5d97758130cf8eec99862517e7e"}],"database_specific":{"cpe":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"3.14.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["HHVM-3.14.5","HHVM-3.14.4","HHVM-3.14.3","HHVM-3.14.2","HHVM-3.14.1","HHVM-3.14.0","gcc-4.6","HPHP-2.1.0","src-hphp","pre-hhvm"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6873.json","vanir_signatures_modified":"2026-07-08T12:27:35Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e","target":{"file":"hphp/runtime/ext/array/ext_array.cpp","function":"HHVM_FUNCTION"},"deprecated":false,"digest":{"function_hash":"125610103184926962950582925333815305707","length":303},"id":"CVE-2016-6873-02e50422"},{"source":"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e","target":{"file":"hphp/runtime/ext/array/ext_array.cpp","function":"php_array_merge_recursive"},"deprecated":false,"digest":{"length":796,"function_hash":"85853746093120045721078706061501071445"},"id":"CVE-2016-6873-04b4ae07","signature_type":"Function","signature_version":"v1"},{"target":{"file":"hphp/runtime/ext/array/ext_array.cpp","function":"couldRecur"},"deprecated":false,"digest":{"function_hash":"146266446582745356990202896584287219025","length":223},"id":"CVE-2016-6873-6f317480","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e"},{"digest":{"function_hash":"328442204768296124416267005031122186472","length":872},"id":"CVE-2016-6873-7c3b86f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e","target":{"file":"hphp/runtime/ext/array/ext_array.cpp","function":"php_array_replace_recursive"},"deprecated":false},{"id":"CVE-2016-6873-a91737e7","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e","target":{"file":"hphp/runtime/ext/array/ext_array.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["97361547630027322574222647014124852281","78903862613093397262113004768607414511","76765149538626271068897607737099354073","321476246634189679197177953373852899976","248672525003541227847887461059484603905","195485375378949632513157155182160058284","71886400786605584585836567979641842149","338626650070849102615054970750623059441","86125372370983923170963321836882601909","289725860449185516231204320354585492073","257334469680627901587349474656674537328","154849570881591230381242151849890572849","326805423876088448169918127897408315408","337807628311309867437776118780534299514","312758995874743756866805394665251027946","98317148521411626441563381943965899622","39295752359109139992725667355539978079","101401039760345960202110396765246996862","217587960885088870813847440557907263039","229527666502967812146007611241585244051","15695188223898260009332610533408179547","75344745195936675426714391345725018353","126954964390694268661484508007218851362","272005485538011712676942871332506373561","287359401698848343517626337763810182055","238435803054599643781881065999149726119","136575586570090622231093315131856701782","87586029857131106200540775548874032624","272005485538011712676942871332506373561","287359401698848343517626337763810182055","238435803054599643781881065999149726119","136575586570090622231093315131856701782","87586029857131106200540775548874032624"]}},{"deprecated":false,"digest":{"length":355,"function_hash":"190016695376741468043394676901712689603"},"id":"CVE-2016-6873-d8b290bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e","target":{"file":"hphp/runtime/ext/array/ext_array.cpp","function":"HHVM_FUNCTION"}},{"target":{"file":"hphp/runtime/ext/array/ext_array.cpp","function":"compact"},"deprecated":false,"digest":{"function_hash":"23110508029818134001336601187523389830","length":437},"id":"CVE-2016-6873-e16f98da","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}