{"id":"CVE-2018-6340","details":"The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).","modified":"2026-07-08T19:45:50.172907Z","published":"2018-12-31T22:29:00.327Z","references":[{"type":"ADVISORY","url":"https://hhvm.com/blog/2018/12/18/hhvm-3.30.1.html"},{"type":"FIX","url":"https://github.com/facebook/hhvm/commit/4bff3bfbe90d10451e4638c2118d1ad1117bb3e3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/hhvm","events":[{"introduced":"0"},{"last_affected":"b14f761969e2ce2b52d7e49e40fa6c58bf43e477"},{"introduced":"68dd840917c9051225b38206fa61791bb68767fb"},{"last_affected":"68dd840917c9051225b38206fa61791bb68767fb"},{"fixed":"4bff3bfbe90d10451e4638c2118d1ad1117bb3e3"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","cpe:2.3:a:facebook:hhvm:3.30:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"3.27.4"},{"introduced":"3.30"},{"last_affected":"3.30"}]}}],"versions":["3.30","HHVM-3.30.0","HHVM-3.27.4","HHVM-3.27.3","HHVM-3.27.2","HHVM-3.27.1","HHVM-3.27.0","gcc-4.6","HPHP-2.1.0","src-hphp","pre-hhvm"],"database_specific":{"vanir_signatures_modified":"2026-07-08T19:45:50Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/4bff3bfbe90d10451e4638c2118d1ad1117bb3e3","target":{"file":"hphp/runtime/ext/memcache/ext_memcache.cpp"},"deprecated":false,"digest":{"line_hashes":["116564641396687826113900405628999369625","21774775140771433607482445078296649987","303445089841589477335468234910063791589","144999778143332345031462876879788916","166763316921933684750743218590549376416","98205108961281931698783479048599115314","232435788303493606933045906010694340051","207902721299876498611867447560711196122","272037669034391791871429191000019108581","7149308680592616907251226590734153967"],"threshold":0.9},"id":"CVE-2018-6340-78d54a2b","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"135018026017869968280818258264908976148","length":832},"id":"CVE-2018-6340-e8aa8c0f","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/4bff3bfbe90d10451e4638c2118d1ad1117bb3e3","target":{"function":"HHVM_METHOD","file":"hphp/runtime/ext/memcache/ext_memcache.cpp"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6340.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}