CVE-2020-1898
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
| Software | From | Fixed in |
|---|---|---|
| facebook / hhvm | 4.58.0 | 4.58.0.x |
| facebook / hhvm | 4.58.1 | 4.58.1.x |
| facebook / hhvm | 4.59.0 | 4.59.0.x |
| facebook / hhvm | 4.60.0 | 4.60.0.x |
| facebook / hhvm | 4.61.0 | 4.61.0.x |
| facebook / hhvm | 4.62.0 | 4.62.0.x |
| facebook / hhvm | 4.57.0 | 4.57.0.x |
| facebook / hhvm | 4.33.0 | 4.56.1 |
| facebook / hhvm | - | 4.32.3 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime