{"id":"CVE-2016-6875","details":"Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.","modified":"2026-07-08T12:53:03.972272Z","published":"2017-02-17T17:59:01.140Z","references":[{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2016/08/11/1"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2016/08/19/1"},{"type":"FIX","url":"https://github.com/facebook/hhvm/commit/1888810e77b446a79a7674784d5f139fcfa605e2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/hhvm","events":[{"introduced":"0"},{"last_affected":"c6bf714e6468213eed377527b431e9cd4cec1432"},{"fixed":"1888810e77b446a79a7674784d5f139fcfa605e2"}],"database_specific":{"cpe":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"3.14.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["HHVM-3.14.5","HHVM-3.14.4","HHVM-3.14.3","HHVM-3.14.2","HHVM-3.14.1","HHVM-3.14.0","gcc-4.6","HPHP-2.1.0","src-hphp","pre-hhvm"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6875.json","vanir_signatures_modified":"2026-07-08T12:53:03Z","vanir_signatures":[{"id":"CVE-2016-6875-18e607dc","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/1888810e77b446a79a7674784d5f139fcfa605e2","target":{"file":"hphp/runtime/ext/wddx/ext_wddx.cpp"},"deprecated":false,"digest":{"line_hashes":["76297515596572548142676573148034841838","175746803774406424921840425508106861864","167897691110371861136565504032950625350","93035593523402503352778961287468455116","46466422116042227653228369214739744365","117257128500912968444444644164695571231","189003099043617438951512165831165224573","107329065183615963795663747441467153380","291619946007508725164843786079283068574","301507225113634883713923931054769035002","333532474214320857176391028886472576015","274910130862199735208783863332695770281","86122892845394419550349236841050960377","26623336131808316217366416948688841525","80265113851266134412492155967057858047","72246276943876773757498017735374572579","241403812568583213671270173532321798460","259613982861258657114095164670104131323","303985175454384902793161908580977793515","216516024934393105568142835782703347590","314738675635936429941176674002252564567","275515862393996140971613522286944904793"],"threshold":0.9}},{"source":"https://github.com/facebook/hhvm/commit/1888810e77b446a79a7674784d5f139fcfa605e2","target":{"file":"hphp/runtime/ext/wddx/ext_wddx.h"},"deprecated":false,"digest":{"line_hashes":["78751173785827356294180259296160039829","210538964558441800395649364488499641069","161735090181712192574971403022679950508","206021377363724860345475610751683518653","152138425784359092976991151174525591429","52031854424960527970229119656044167980","5486123268443892645300441762055955837"],"threshold":0.9},"id":"CVE-2016-6875-44448c99","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"320552028476698702792096574859269024060","length":2040},"id":"CVE-2016-6875-b5e1b509","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/1888810e77b446a79a7674784d5f139fcfa605e2","target":{"file":"hphp/runtime/ext/wddx/ext_wddx.cpp","function":"WddxPacket::recursiveAddVar"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}