PatchSiren cyber security CVE debrief
CVE-2016-6874 Facebook CVE debrief
CVE-2016-6874 is a critical vulnerability in Facebook HHVM affecting the array_*_recursive functions. The official record and NVD identify HHVM versions up to 3.14.5 as vulnerable, with the issue fixed in 3.15.0. NVD scores the flaw 9.8/CRITICAL and describes the attack surface as network-reachable with no user interaction or privileges required. Because the published description only says the impact is unspecified and related to recursion, defenders should treat this as a severe pre-authentication bug in exposed HHVM deployments and upgrade promptly.
- Vendor
- Product
- Hhvm
- CVSS
- CRITICAL 9.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-17
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-17
- Advisory updated
- 2026-05-13
Who should care
Organizations running Facebook HHVM, especially internet-facing PHP/Hack application stacks that still use HHVM versions earlier than 3.15.0. Security teams responsible for patching, web platform operations, and asset owners with legacy HHVM services should prioritize this advisory.
Technical summary
The vulnerability is described as affecting HHVM's array_*_recursive functions and being related to recursion. The NVD entry classifies affected releases as HHVM through 3.14.5 and assigns CVSS v3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable issue with no authentication or user interaction required. The source references include public OSS-security disclosure messages and a GitHub commit in the HHVM repository, supporting that the flaw was publicly discussed and subsequently fixed in the project.
Defensive priority
Immediate for any exposed or still-supported HHVM deployment. This is a pre-authentication, network-reachable, critical-severity issue with broad CIA impact in NVD scoring, so remediation should be scheduled ahead of routine maintenance.
Recommended defensive actions
- Upgrade HHVM to 3.15.0 or later, or remove/retire HHVM if it is no longer required.
- Inventory all services that depend on HHVM, including legacy or containerized deployments that may not be visible in standard web server inventories.
- Prioritize externally reachable HHVM instances for emergency patching and validate that no older 3.14.x builds remain in production.
- Use the official NVD and CVE records to confirm affected version ranges before applying compensating controls.
- If immediate upgrade is not possible, isolate the service from untrusted networks and place it behind strict access controls until remediation is complete.
Evidence notes
All statements are based on the supplied NVD record and listed references. The NVD data identifies the affected CPE range as HHVM versions through 3.14.5 and provides the CVSS v3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The description states the flaw involves the array_*_recursive functions and recursion, but does not provide a more specific exploitation mechanism. The OSS-security references show public disclosure activity in August 2016, and the HHVM GitHub commit reference indicates a project fix exists, but the exact code-change details are not inferred here.
Sources and references
Verified primary and authoritative sources
-
CVE-2016-6874 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2016-6874
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2016-6874 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6874
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/facebook/hhvm/commit/05e706d98f748f609b19d8697e490eaab5007d69
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.