PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6873 Facebook CVE debrief

CVE-2016-6873 affects Facebook HHVM before 3.15.0. The public description says self-recursion in compact can be triggered with unspecified impact via unknown vectors. NVD assigns a critical 9.8 score and lists conditions that do not require privileges or user interaction, so exposed HHVM deployments should be treated as urgent patch candidates. Public references in oss-security appeared in August 2016, and the CVE record was published on 2017-02-17.

Vendor
Facebook
Product
Hhvm
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-17
Original CVE updated
2026-05-13
Advisory published
2017-02-17
Advisory updated
2026-05-13

Who should care

Operators and developers running Facebook HHVM, especially internet-facing services that still include versions in the affected range. Security teams responsible for asset inventory, patching, and service hardening should prioritize it.

Technical summary

The vulnerability is described as a self-recursion problem in HHVM's compact handling. The corpus does not provide a deeper root-cause explanation, but it does identify affected HHVM versions before 3.15.0 and NVD maps vulnerable CPE coverage through 3.14.5. The official CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which is why NVD classifies it as critical.

Defensive priority

Immediate

Recommended defensive actions

  • Upgrade HHVM to 3.15.0 or a later fixed release.
  • Inventory all systems that include HHVM and confirm none remain on vulnerable versions.
  • Prioritize patching of externally reachable HHVM deployments.
  • After updating, monitor for abnormal crashes or recursion-related errors and validate application behavior.
  • If immediate patching is not possible, reduce exposure by restricting access to HHVM services.

Evidence notes

Source evidence is limited to the CVE/NVD record, two oss-security mailing list references from 2016-08-11 and 2016-08-19, and the upstream Facebook HHVM patch commit e264f04ae825a5d97758130cf8eec99862517e7e. The description states 'before 3.15.0,' while the NVD CPE range marks versions through 3.14.5 as vulnerable; both indicate a pre-3.15.0 fix boundary, but the corpus does not clarify the exact last affected build beyond the NVD range.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6873 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6873

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6873 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6873

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.