Critical severity9.8NVD Advisory· Published Mar 11, 2021· Updated Jun 17, 2026
CVE-2020-1900
CVE-2020-1900
Description
When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*range: <4.32.3
- cpe:2.3:a:facebook:hhvm:4.57.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.58.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.58.1:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.59.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.60.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.61.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.62.0:*:*:*:*:*:*:*
- (no CPE)range: <4.32.3, 4.33.0-4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0
- (no CPE)range: 4.62.0
Patches
Vulnerability mechanics
References
2- github.com/facebook/hhvm/commit/c1c4bb0cf9e076aafaf4ff3515556ef9faf906f3nvdPatchThird Party Advisory
- hhvm.com/blog/2020/06/30/security-update.htmlnvdVendor Advisory
News mentions
0No linked articles in our index yet.