Critical
Security advisory
Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11935
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:28 UTC · Revision 1
Source evidence
Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
osv:CVE-2019-11935
Complete source record
{
"id": "80773525383ed33348672a13eb73b4d00ba65c9b65af55888bf89191380345b9",
"url": "https://osv.dev/vulnerability/CVE-2019-11935",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11935",
"summary": "Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.",
"evidence": "osv:CVE-2019-11935",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-11935",
"aliases": [
"CVE-2019-11935"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebook/hhvm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "abe9500970b23bc9c385bf18a15bd38e830859a6"
},
{
"introduced": "7d4f701b9ed004452d695fce4e1ef8f48babbf39"
},
{
"last_affected": "8384c051684f8bd1a8b0238a25b2ef4c9e3463d0"
},
{
"introduced": "0abb3b0c92e938bb7dac2d0c1603c5866e2a035b"
},
{
"last_affected": "0ebbb8cc2ba783424d555f4267c0e27b6731e070"
},
{
"introduced": "e3998b66312ebadd59b3a825f489a25bdb6f4ad3"
},
{
"last_affected": "3f60b1f405b36bec6d85b4070ac066710f584032"
},
{
"fixed": "1c518555dba6ceb45d5ba61845b96e261219c3b7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.30.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0"
},
{
"last_affected": "4.8.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.9.0"
},
{
"last_affected": "4.23.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.24.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.24.0"
},
{
"last_affected": "4.24.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.25.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.25.0"
},
{
"last_affected": "4.25.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.26.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.26.0"
},
{
"last_affected": "4.26.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.27.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.27.0"
},
{
"last_affected": "4.27.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.28.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.28.0"
},
{
"last_affected": "4.28.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.28.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.28.1"
},
{
"last_affected": "4.28.1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "1c518555dba6ceb45d5ba61845b96e261219c3b7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"4.24.0",
"4.25.0",
"4.26.0",
"4.27.0",
"4.28.0",
"4.28.1",
"nightly-2019.10.29",
"nightly-2019.10.28",
"nightly-2019.10.27",
"nightly-2019.10.26",
"nightly-2019.10.25",
"nightly-2019.10.24",
"HHVM-4.28.1",
"nightly-2019.10.23",
"nightly-2019.10.22",
"nightly-2019.10.21",
"HHVM-4.28.0",
"nightly-2019.10.20",
"nightly-2019.10.19",
"nightly-2019.10.18",
"nightly-2019.10.17",
"nightly-2019.10.16",
"nightly-2019.10.15",
"nightly-2019.10.14",
"nightly-2019.10.13",
"nightly-2019.10.12",
"nightly-2019.10.11",
"nightly-2019.10.10",
"nightly-2019.10.09",
"nightly-2019.10.08",
"nightly-2019.10.07",
"nightly-2019.10.06",
"nightly-2019.10.05",
"nightly-2019.10.04",
"nightly-2019.10.03",
"nightly-2019.10.02",
"nightly-2019.10.01",
"nightly-2019.09.30",
"nightly-2019.09.29",
"nightly-2019.09.28",
"nightly-2019.09.27",
"nightly-2019.09.26",
"nightly-2019.09.25",
"nightly-2019.09.24",
"HHVM-4.23.1",
"HHVM-4.8.5",
"HHVM-3.30.11",
"nightly-2019.09.23",
"nightly-2019.09.22",
"nightly-2019.09.21",
"nightly-2019.09.20",
"nightly-2019.09.19",
"nightly-2019.09.18",
"HHVM-4.23.0",
"nightly-2019.09.17",
"nightly-2019.09.16",
"nightly-2019.09.15",
"nightly-2019.09.14",
"nightly-2019.09.13",
"nightly-2019.09.12",
"nightly-2019.09.11",
"nightly-2019.09.10",
"nightly-2019.09.09",
"nightly-2019.09.08",
"nightly-2019.09.07",
"nightly-2019.09.06",
"nightly-2019.09.05",
"nightly-2019.09.04",
"HHVM-4.8.4",
"HHVM-3.30.10",
"nightly-2019.09.03",
"nightly-2019.09.02",
"nightly-2019.09.01",
"nightly-2019.08.31",
"nightly-2019.08.30",
"nightly-2019.08.29",
"nightly-2019.08.28",
"nightly-2019.08.27",
"nightly-2019.08.26",
"nightly-2019.08.25",
"nightly-2019.08.24",
"nightly-2019.08.23",
"nightly-2019.08.22",
"nightly-2019.08.21",
"nightly-2019.08.20",
"nightly-2019.08.19",
"nightly-2019.08.18",
"nightly-2019.08.17",
"nightly-2019.08.16",
"nightly-2019.08.15",
"nightly-2019.08.14",
"HHVM-4.8.3",
"HHVM-3.30.9",
"nightly-2019.08.13",
"nightly-2019.08.12",
"nightly-2019.08.11",
"nightly-2019.08.10",
"nightly-2019.08.09",
"nightly-2019.08.08",
"HHVM-3.30.8",
"HHVM-3.30.7",
"HHVM-4.8.2",
"nightly-2019.08.07",
"nightly-2019.08.06",
"nightly-2019.08.05",
"nightly-2019.08.04",
"nightly-2019.08.03",
"nightly-2019.08.02",
"nightly-2019.08.01",
"nightly-2019.07.31",
"nightly-2019.07.30",
"nightly-2019.07.29",
"nightly-2019.07.28",
"nightly-2019.07.27",
"nightly-2019.07.26",
"nightly-2019.07.25",
"nightly-2019.07.24",
"nightly-2019.07.23",
"nightly-2019.07.22",
"nightly-2019.07.21",
"nightly-2019.07.20",
"nightly-2019.07.19",
"nightly-2019.07.18",
"nightly-2019.07.17",
"nightly-2019.07.16",
"nightly-2019.07.15",
"nightly-2019.07.14",
"nightly-2019.07.13",
"nightly-2019.07.12",
"nightly-2019.07.11",
"nightly-2019.07.10",
"nightly-2019.07.09",
"nightly-2019.07.08",
"nightly-2019.07.07",
"nightly-2019.07.06",
"nightly-2019.07.05",
"nightly-2019.07.04",
"nightly-2019.07.03",
"nightly-2019.07.02",
"nightly-2019.07.01",
"nightly-2019.06.30",
"nightly-2019.06.29",
"nightly-2019.06.28",
"nightly-2019.06.27",
"nightly-2019.06.26",
"nightly-2019.06.25",
"nightly-2019.06.24",
"nightly-2019.06.23",
"nightly-2019.06.22",
"nightly-2019.06.21",
"nightly-2019.06.20",
"nightly-2019.06.19",
"nightly-2019.06.17",
"nightly-2019.06.18",
"nightly-2019.06.16",
"nightly-2019.06.15",
"nightly-2019.06.14",
"nightly-2019.06.13",
"nightly-2019.06.12",
"nightly-2019.06.11",
"nightly-2019.06.10",
"HHVM-3.30.6",
"HHVM-4.8.1",
"nightly-2019.06.09",
"nightly-2019.06.08",
"nightly-2019.06.07",
"nightly-2019.06.06",
"nightly-2019.06.05",
"nightly-2019.06.04",
"HHVM-4.8.0",
"nightly-2019.06.03",
"nightly-2019.06.02",
"nightly-2019.06.01",
"nightly-2019.05.31",
"nightly-2019.05.30",
"nightly-2019.05.29",
"nightly-2019.05.28",
"nightly-2019.05.27",
"nightly-2019.05.26",
"nightly-2019.05.25",
"nightly-2019.05.24",
"nightly-2019.05.23",
"nightly-2019.05.22",
"nightly-2019.05.21",
"nightly-2019.05.20",
"nightly-2019.05.19",
"nightly-2019.05.18",
"nightly-2019.05.17",
"nightly-2019.05.16",
"nightly-2019.05.15",
"nightly-2019.05.14",
"nightly-2019.05.13",
"nightly-2019.05.12",
"nightly-2019.05.11",
"nightly-2019.05.10",
"nightly-2019.05.09",
"nightly-2019.05.08",
"nightly-2019.05.07",
"nightly-2019.05.06",
"nightly-2019.05.05",
"nightly-2019.05.04",
"nightly-2019.05.03",
"nightly-2019.05.02",
"nightly-2019.05.01",
"nightly-2019.04.30",
"nightly-2019.04.29",
"nightly-2019.04.28",
"nightly-2019.04.27",
"nightly-2019.04.26",
"nightly-2019.04.25",
"nightly-2019.04.24",
"nightly-2019.04.22",
"nightly-2019.04.23",
"nightly-2019.04.21",
"nightly-2019.04.20",
"nightly-2019.04.19",
"nightly-2019.04.18",
"nightly-2019.04.17",
"nightly-2019.04.16",
"nightly-2019.04.15",
"nightly-2019.04.14",
"nightly-2019.04.13",
"nightly-2019.04.12",
"nightly-2019.04.11",
"nightly-2019.04.10",
"nightly-2019.04.09",
"nightly-2019.04.08",
"nightly-2019.04.07",
"nightly-2019.04.06",
"nightly-2019.04.05",
"nightly-2019.04.04",
"HHVM-3.30.5",
"nightly-2019.04.03",
"nightly-2019.04.02",
"nightly-2019.04.01",
"nightly-2019.03.31",
"nightly-2019.03.30",
"nightly-2019.03.29",
"nightly-2019.03.28",
"HHVM-3.30.4",
"HHVM-3.30.3",
"HHVM-3.30.2",
"HHVM-3.30.1",
"HHVM-3.30.0",
"gcc-4.6",
"HPHP-2.1.0",
"src-hphp",
"pre-hhvm"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11935.json",
"vanir_signatures": [
{
"id": "CVE-2019-11935-ad688d4d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133668036051771783543419871597262375468",
"129641396530610067548535575096508259636",
"304861650904458673854477435002975464077",
"140335216194151808759673220052749435881"
]
},
"source": "https://github.com/facebook/hhvm/commit/abe9500970b23bc9c385bf18a15bd38e830859a6",
"target": {
"file": "hphp/runtime/version.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11935-fc72bb9d",
"digest": {
"length": 2769,
"function_hash": "67261565572537812702813700662715846835"
},
"source": "https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7",
"target": {
"file": "hphp/runtime/ext/mbstring/ext_mbstring.cpp",
"function": "_php_mb_regex_ereg_replace_exec"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11935-ffb13af5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315728158854300467802016852028258470782",
"311692162243677398358948376420990517139",
"307710948694442023051359734482804642074",
"331377461075004981746843192991985630094",
"231257040834705008125684766828505557808",
"183126571683132819527685269272462918491",
"322041387970398611266313427073664593435",
"84913048491360638706325140868666790750",
"3394884979863319369977819634067540547",
"319458021223391047711524471512709978215",
"134684807424976824708472242385985118914",
"269112849239790915317727707658430498295"
]
},
"source": "https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7",
"target": {
"file": "hphp/runtime/ext/mbstring/ext_mbstring.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:39:46Z"
}
}
],
"modified": "2026-10-20T13:39:46.228526796Z",
"provider": "osv",
"references": [
"https://hhvm.com/blog/2019/10/28/security-update.html",
"https://www.facebook.com/security/advisories/cve-2019-11935",
"https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-11935",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387917,
"published_at": "2019-12-04T17:16:43.257+00:00"
}