{"id":"CVE-2018-6335","details":"A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. This affects all supported versions of HHVM (3.25.2, 3.24.6, and 3.21.10 and below) when using the proxygen server to handle HTTP2 requests.","modified":"2026-07-08T19:45:51.973791Z","published":"2018-12-31T19:29:00.417Z","references":[{"type":"ADVISORY","url":"https://hhvm.com/blog/2018/05/04/hhvm-3.25.3.html"},{"type":"FIX","url":"https://github.com/facebook/hhvm/commit/4cb57dd753a339654ca464c139db9871fe961d56"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/hhvm","events":[{"introduced":"0"},{"last_affected":"fff094b066f4780b175befeb9ba949f9dcf73d8c"},{"introduced":"5f227331c426ef58513feb5c92ffd0a705067b2f"},{"last_affected":"95ec9d36f4b1bc49e70c0752ce4b531f27a1429a"},{"fixed":"4cb57dd753a339654ca464c139db9871fe961d56"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","cpe:2.3:a:facebook:hhvm:3.24.6:*:*:*:*:*:*:*","cpe:2.3:a:facebook:hhvm:3.25.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"3.21.10"},{"introduced":"3.24.6"},{"last_affected":"3.24.6"},{"introduced":"3.25.2"},{"last_affected":"3.25.2"}]}}],"versions":["3.24.6","3.25.2","HHVM-3.21.10","HHVM-3.25.2","HHVM-3.25.1","HHVM-3.21.9","HHVM-3.25.0","HHVM-3.21.8","HHVM-3.21.7","HHVM-3.21.6","HHVM-3.21.5","HHVM-3.21.4","HHVM-3.21.3","HHVM-3.21.2","HHVM-3.21.1","HHVM-3.21.0","gcc-4.6","HPHP-2.1.0","src-hphp","pre-hhvm"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6335.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}