High
Security advisory
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-1898
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:34 UTC · Revision 1
Source evidence
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
osv:CVE-2020-1898
Complete source record
{
"id": "43444108d1aeaf7d978092d7271dfdd5cac421d149a28c590b1d2e0482d39f62",
"url": "https://osv.dev/vulnerability/CVE-2020-1898",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-1898",
"summary": "The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.",
"evidence": "osv:CVE-2020-1898",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-1898",
"aliases": [
"CVE-2020-1898"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebook/hhvm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d6af4b525b31c96526b2508642d58dbf5c7d496c"
},
{
"introduced": "8df1dd7ead93f50388145dd8d7734a69204b50a7"
},
{
"fixed": "55dc2e1650c1e79e67b7f0ef20e51cd2d504a4bb"
},
{
"introduced": "ce87598e3c65a922a6e25c7119e2446f1fa6a4b6"
},
{
"last_affected": "2fe7d70e6da93772c770dee950542cac80b5bc2f"
},
{
"fixed": "1746dfb11fc0048366f34669e74318b8278a684c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.32.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.33.0"
},
{
"fixed": "4.56.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.57.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.57.0"
},
{
"last_affected": "4.57.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.58.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.58.0"
},
{
"last_affected": "4.58.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.58.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.58.1"
},
{
"last_affected": "4.58.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.59.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.59.0"
},
{
"last_affected": "4.59.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.60.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.60.0"
},
{
"last_affected": "4.60.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.61.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.61.0"
},
{
"last_affected": "4.61.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.62.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.62.0"
},
{
"last_affected": "4.62.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "1746dfb11fc0048366f34669e74318b8278a684c"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"4.57.0",
"4.58.0",
"4.58.1",
"4.59.0",
"4.60.0",
"4.61.0",
"4.62.0",
"nightly-2020.06.30",
"nightly-2020.06.29",
"nightly-2020.06.28",
"nightly-2020.06.27",
"nightly-2020.06.26",
"nightly-2020.06.25",
"nightly-2020.06.24",
"nightly-2020.06.23",
"nightly-2020.06.22",
"nightly-2020.06.21",
"nightly-2020.06.20",
"nightly-2020.06.19",
"nightly-2020.06.18",
"nightly-2020.06.17",
"nightly-2020.06.16",
"HHVM-4.62.0",
"nightly-2020.06.15",
"nightly-2020.06.14",
"nightly-2020.06.13",
"nightly-2020.06.12",
"nightly-2020.06.11",
"nightly-2020.06.10",
"nightly-2020.06.09",
"nightly-2020.06.08",
"nightly-2020.06.07",
"nightly-2020.06.06",
"nightly-2020.06.05",
"nightly-2020.06.04",
"nightly-2020.06.03",
"nightly-2020.06.02",
"nightly-2020.06.01",
"nightly-2020.05.31",
"nightly-2020.05.30",
"nightly-2020.05.29",
"nightly-2020.05.28",
"nightly-2020.05.27",
"nightly-2020.05.26",
"nightly-2020.05.25",
"nightly-2020.05.24",
"nightly-2020.05.23",
"nightly-2020.05.22",
"nightly-2020.05.21",
"nightly-2020.05.20",
"nightly-2020.05.19",
"nightly-2020.05.18",
"nightly-2020.05.17",
"nightly-2020.05.16",
"nightly-2020.05.15",
"nightly-2020.05.14",
"nightly-2020.05.13",
"nightly-2020.05.12",
"nightly-2020.05.11",
"nightly-2020.05.10",
"nightly-2020.05.09",
"nightly-2020.05.08",
"nightly-2020.05.07",
"nightly-2020.05.06",
"nightly-2020.05.05",
"HHVM-4.56.0",
"nightly-2020.05.04",
"nightly-2020.05.03",
"nightly-2020.05.02",
"nightly-2020.05.01",
"nightly-2020.04.30",
"nightly-2020.04.29",
"nightly-2020.04.28",
"nightly-2020.04.27",
"nightly-2020.04.26",
"nightly-2020.04.25",
"nightly-2020.04.24",
"HHVM-4.32.2",
"nightly-2020.04.23",
"nightly-2020.04.22",
"nightly-2020.04.21",
"nightly-2020.04.20",
"nightly-2020.04.19",
"nightly-2020.04.18",
"nightly-2020.04.17",
"nightly-2020.04.16",
"nightly-2020.04.15",
"nightly-2020.04.14",
"nightly-2020.04.13",
"nightly-2020.04.12",
"nightly-2020.04.11",
"nightly-2020.04.10",
"nightly-2020.04.09",
"nightly-2020.04.08",
"nightly-2020.04.07",
"nightly-2020.04.06",
"nightly-2020.04.05",
"nightly-2020.04.04",
"nightly-2020.04.03",
"nightly-2020.04.02",
"nightly-2020.04.01",
"nightly-2020.03.31",
"nightly-2020.03.30",
"nightly-2020.03.29",
"nightly-2020.03.28",
"nightly-2020.03.27",
"nightly-2020.03.26",
"nightly-2020.03.25",
"nightly-2020.03.24",
"nightly-2020.03.23",
"nightly-2020.03.22",
"nightly-2020.03.21",
"nightly-2020.03.20",
"nightly-2020.03.19",
"nightly-2020.03.18",
"nightly-2020.03.17",
"nightly-2020.03.16",
"nightly-2020.03.15",
"nightly-2020.03.14",
"nightly-2020.03.13",
"nightly-2020.03.12",
"nightly-2020.03.11",
"nightly-2020.03.10",
"nightly-2020.03.09",
"nightly-2020.03.08",
"nightly-2020.03.07",
"nightly-2020.03.06",
"nightly-2020.03.05",
"nightly-2020.03.04",
"nightly-2020.03.03",
"nightly-2020.03.02",
"nightly-2020.03.01",
"nightly-2020.02.29",
"nightly-2020.02.28",
"nightly-2020.02.27",
"nightly-2020.02.26",
"nightly-2020.02.25",
"nightly-2020.02.24",
"nightly-2020.02.23",
"nightly-2020.02.22",
"nightly-2020.02.21",
"nightly-2020.02.20",
"nightly-2020.02.19",
"HHVM-4.32.1",
"nightly-2020.02.18",
"nightly-2020.02.17",
"nightly-2020.02.16",
"nightly-2020.02.15",
"nightly-2020.02.14",
"nightly-2020.02.13",
"nightly-2020.02.12",
"nightly-2020.02.11",
"nightly-2020.02.10",
"nightly-2020.02.09",
"nightly-2020.02.08",
"nightly-2020.02.07",
"nightly-2020.02.06",
"nightly-2020.02.05",
"nightly-2020.02.04",
"nightly-2020.02.03",
"nightly-2020.02.02",
"nightly-2020.02.01",
"nightly-2020.01.31",
"nightly-2020.01.30",
"nightly-2020.01.29",
"nightly-2020.01.28",
"nightly-2020.01.27",
"nightly-2020.01.26",
"nightly-2020.01.25",
"nightly-2020.01.24",
"nightly-2020.01.23",
"nightly-2020.01.22",
"nightly-2020.01.21",
"nightly-2020.01.20",
"nightly-2020.01.19",
"nightly-2020.01.18",
"nightly-2020.01.17",
"nightly-2020.01.16",
"nightly-2020.01.15",
"nightly-2020.01.14",
"nightly-2020.01.13",
"nightly-2020.01.12",
"nightly-2020.01.11",
"nightly-2020.01.10",
"nightly-2020.01.09",
"nightly-2020.01.08",
"nightly-2020.01.07",
"nightly-2020.01.06",
"nightly-2020.01.05",
"nightly-2020.01.04",
"nightly-2020.01.03",
"nightly-2020.01.02",
"nightly-2020.01.01",
"nightly-2019.12.31",
"nightly-2019.12.30",
"nightly-2019.12.29",
"nightly-2019.12.28",
"nightly-2019.12.27",
"nightly-2019.12.26",
"nightly-2019.12.25",
"nightly-2019.12.24",
"nightly-2019.12.23",
"nightly-2019.12.22",
"nightly-2019.12.21",
"nightly-2019.12.20",
"nightly-2019.12.19",
"nightly-2019.12.18",
"nightly-2019.12.17",
"nightly-2019.12.16",
"nightly-2019.12.15",
"nightly-2019.12.14",
"nightly-2019.12.13",
"nightly-2019.12.12",
"nightly-2019.12.11",
"nightly-2019.12.09",
"nightly-2019.12.10",
"nightly-2019.12.08",
"nightly-2019.12.07",
"nightly-2019.12.06",
"nightly-2019.12.05",
"nightly-2019.12.04",
"nightly-2019.12.03",
"nightly-2019.12.02",
"nightly-2019.12.01",
"nightly-2019.11.30",
"nightly-2019.11.29",
"nightly-2019.11.28",
"nightly-2019.11.27",
"nightly-2019.11.26",
"nightly-2019.11.25",
"nightly-2019.11.24",
"nightly-2019.11.23",
"nightly-2019.11.22",
"nightly-2019.11.21",
"nightly-2019.11.20",
"nightly-2019.11.19",
"HHVM-4.32.0",
"nightly-2019.11.18",
"nightly-2019.11.17",
"nightly-2019.11.16",
"nightly-2019.11.15",
"nightly-2019.11.14",
"nightly-2019.11.13",
"nightly-2019.11.12",
"nightly-2019.11.11",
"nightly-2019.11.10",
"nightly-2019.11.09",
"nightly-2019.11.08",
"nightly-2019.11.07",
"nightly-2019.11.06",
"nightly-2019.11.05",
"nightly-2019.11.04",
"nightly-2019.11.03",
"nightly-2019.11.02",
"nightly-2019.11.01",
"nightly-2019.10.31",
"nightly-2019.10.30",
"nightly-2019.10.29",
"nightly-2019.10.28",
"nightly-2019.10.27",
"nightly-2019.10.26",
"nightly-2019.10.25",
"nightly-2019.10.24",
"nightly-2019.10.23",
"nightly-2019.10.22",
"nightly-2019.10.21",
"nightly-2019.10.20",
"nightly-2019.10.19",
"nightly-2019.10.18",
"nightly-2019.10.17",
"nightly-2019.10.16",
"nightly-2019.10.15",
"nightly-2019.10.14",
"nightly-2019.10.13",
"nightly-2019.10.12",
"nightly-2019.10.11",
"nightly-2019.10.10",
"nightly-2019.10.09",
"nightly-2019.10.08",
"nightly-2019.10.07",
"nightly-2019.10.06",
"nightly-2019.10.05",
"nightly-2019.10.04",
"nightly-2019.10.03",
"nightly-2019.10.02",
"nightly-2019.10.01",
"nightly-2019.09.30",
"nightly-2019.09.29",
"nightly-2019.09.28",
"nightly-2019.09.27",
"nightly-2019.09.26",
"nightly-2019.09.25",
"nightly-2019.09.24",
"nightly-2019.09.23",
"nightly-2019.09.22",
"nightly-2019.09.21",
"nightly-2019.09.20",
"nightly-2019.09.19",
"nightly-2019.09.18",
"nightly-2019.09.17",
"nightly-2019.09.16",
"nightly-2019.09.15",
"nightly-2019.09.14",
"nightly-2019.09.13",
"nightly-2019.09.12",
"nightly-2019.09.11",
"nightly-2019.09.10",
"nightly-2019.09.09",
"nightly-2019.09.08",
"nightly-2019.09.07",
"nightly-2019.09.06",
"nightly-2019.09.05",
"nightly-2019.09.04",
"nightly-2019.09.03",
"nightly-2019.09.02",
"nightly-2019.09.01",
"nightly-2019.08.31",
"nightly-2019.08.30",
"nightly-2019.08.29",
"nightly-2019.08.28",
"nightly-2019.08.27",
"nightly-2019.08.26",
"nightly-2019.08.25",
"nightly-2019.08.24",
"nightly-2019.08.23",
"nightly-2019.08.22",
"nightly-2019.08.21",
"nightly-2019.08.20",
"nightly-2019.08.19",
"nightly-2019.08.18",
"nightly-2019.08.17",
"nightly-2019.08.16",
"nightly-2019.08.15",
"nightly-2019.08.14",
"nightly-2019.08.13",
"nightly-2019.08.12",
"nightly-2019.08.11",
"nightly-2019.08.10",
"nightly-2019.08.09",
"nightly-2019.08.08",
"nightly-2019.08.07",
"nightly-2019.08.06",
"nightly-2019.08.05",
"nightly-2019.08.04",
"nightly-2019.08.03",
"nightly-2019.08.02",
"nightly-2019.08.01",
"nightly-2019.07.31",
"nightly-2019.07.30",
"nightly-2019.07.29",
"nightly-2019.07.28",
"nightly-2019.07.27",
"nightly-2019.07.26",
"nightly-2019.07.25",
"nightly-2019.07.24",
"nightly-2019.07.23",
"nightly-2019.07.22",
"nightly-2019.07.21",
"nightly-2019.07.20",
"nightly-2019.07.19",
"nightly-2019.07.18",
"nightly-2019.07.17",
"nightly-2019.07.16",
"nightly-2019.07.15",
"nightly-2019.07.14",
"nightly-2019.07.13",
"nightly-2019.07.12",
"nightly-2019.07.11",
"nightly-2019.07.10",
"nightly-2019.07.09",
"nightly-2019.07.08",
"nightly-2019.07.07",
"nightly-2019.07.06",
"nightly-2019.07.05",
"nightly-2019.07.04",
"nightly-2019.07.03",
"nightly-2019.07.02",
"nightly-2019.07.01",
"nightly-2019.06.30",
"nightly-2019.06.29",
"nightly-2019.06.28",
"nightly-2019.06.27",
"nightly-2019.06.26",
"nightly-2019.06.25",
"nightly-2019.06.24",
"nightly-2019.06.23",
"nightly-2019.06.22",
"nightly-2019.06.21",
"nightly-2019.06.20",
"nightly-2019.06.19",
"nightly-2019.06.17",
"nightly-2019.06.18",
"nightly-2019.06.16",
"nightly-2019.06.15",
"nightly-2019.06.14",
"nightly-2019.06.13",
"nightly-2019.06.12",
"nightly-2019.06.11",
"nightly-2019.06.10",
"nightly-2019.06.09",
"nightly-2019.06.08",
"nightly-2019.06.07",
"nightly-2019.06.06",
"nightly-2019.06.05",
"nightly-2019.06.04",
"nightly-2019.06.03",
"nightly-2019.06.02",
"nightly-2019.06.01",
"nightly-2019.05.31",
"nightly-2019.05.30",
"nightly-2019.05.29",
"nightly-2019.05.28",
"nightly-2019.05.27",
"nightly-2019.05.26",
"nightly-2019.05.25",
"nightly-2019.05.24",
"nightly-2019.05.23",
"nightly-2019.05.22",
"nightly-2019.05.21",
"nightly-2019.05.20",
"nightly-2019.05.19",
"nightly-2019.05.18",
"nightly-2019.05.17",
"nightly-2019.05.16",
"nightly-2019.05.15",
"nightly-2019.05.14",
"nightly-2019.05.13",
"nightly-2019.05.12",
"nightly-2019.05.11",
"nightly-2019.05.10",
"nightly-2019.05.09",
"nightly-2019.05.08",
"nightly-2019.05.07",
"nightly-2019.05.06",
"nightly-2019.05.05",
"nightly-2019.05.04",
"nightly-2019.05.03",
"nightly-2019.05.02",
"nightly-2019.05.01",
"nightly-2019.04.30",
"nightly-2019.04.29",
"nightly-2019.04.28",
"nightly-2019.04.27",
"nightly-2019.04.26",
"nightly-2019.04.25",
"nightly-2019.04.24",
"nightly-2019.04.22",
"nightly-2019.04.23",
"nightly-2019.04.21",
"nightly-2019.04.20",
"nightly-2019.04.19",
"nightly-2019.04.18",
"nightly-2019.04.17",
"nightly-2019.04.16",
"nightly-2019.04.15",
"nightly-2019.04.14",
"nightly-2019.04.13",
"nightly-2019.04.12",
"nightly-2019.04.11",
"nightly-2019.04.10",
"nightly-2019.04.09",
"nightly-2019.04.08",
"nightly-2019.04.07",
"nightly-2019.04.06",
"nightly-2019.04.05",
"nightly-2019.04.04",
"nightly-2019.04.03",
"nightly-2019.04.02",
"nightly-2019.04.01",
"nightly-2019.03.31",
"nightly-2019.03.30",
"nightly-2019.03.29",
"nightly-2019.03.28",
"gcc-4.6",
"HPHP-2.1.0",
"src-hphp",
"pre-hhvm"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1898.json",
"vanir_signatures": [
{
"id": "CVE-2020-1898-01d70c0b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"91487532972145899339859786532574555263",
"326407928188406100671830618769666613359",
"21551178943104615310045052536714520650",
"102643094137829386333481076476762460619",
"53700757438239126383670650319917108424",
"51500582980409683476804170736651155826",
"156139227791915618986343167466951799836",
"205429400389998191863297352820906755441",
"170075102244105141743887749498636423900"
]
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/VariantController.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-0a324714",
"digest": {
"length": 280,
"function_hash": "270737160550213031684840760497248981145"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/ext_fb.cpp",
"function": "fb_compact_unserialize"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-434d5d61",
"digest": {
"threshold": 0.9,
"line_hashes": [
"271790096561396052972573032767504935933",
"9777719731318520793473962057681738798",
"61330576844675855404494413271248799124",
"148174822824141929193172826518108165976",
"328166032695495337147219091976196694868",
"214349395177784171051225336605108284220",
"82203661883655628963475664907581886558",
"196692206186613515479464340605539317323",
"263617574364114813576776252851971277771"
]
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-476b11cb",
"digest": {
"length": 2764,
"function_hash": "271762000487680987672107141546529577534"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/ext_fb.cpp",
"function": "fb_compact_unserialize_from_buffer"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-4b6aa8d1",
"digest": {
"length": 249,
"function_hash": "131179548999697731911174089316538092118"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
"function": "unserializeSet"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-77e235e3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"181097208751375604965391235137227738901",
"121698461318138829929899400579623271629",
"135429370249437301008081810350940665424",
"82830804432312628537095303834045631424",
"211681232477740050467309956442190407689",
"75042782117546863220999624039775972463",
"305295146125328853423239815673352858386",
"210021830632294832939226366541382590488",
"95166611366815647396683735030895853612",
"14696346859648069683903721257579375032",
"204337556357967730450398344932202417421",
"2163819038607280028979468262770280214",
"250004932297632704380691985619804240173",
"232600499681413757795049259759294775028",
"306254961887074926476221494525247508884",
"148727549268937441199599944718934469927",
"144204313731998566398968955957564823409",
"149744699588593285435672443775513587895",
"175269912427601477650680453467816310439",
"3421995533911580137166964287704163988",
"281233161262593976314108105375163440949",
"196704612081951055010595689762200058664",
"339272939625009796129722680277925814069",
"336901554468839498434373195411458189813",
"316586586402976138935182021226085738937",
"272483809826078039096693387273673111235",
"67381580523396586748313209181317703136",
"99416485322904319296561357989084698307",
"90078555816722039571428649786829680225",
"79842855803770429953299674130892450781",
"31768561387076061940935759255384140469",
"76966900588068684686280736706371855979",
"316586586402976138935182021226085738937",
"272483809826078039096693387273673111235",
"67381580523396586748313209181317703136",
"99416485322904319296561357989084698307",
"34488496411511293633949836587695075141",
"263117713334405570814752022705720519454",
"199210392761886388648445153050430910664",
"90707207527845928145103593251122919086",
"20070347726977164041672427603721609124",
"54565153198004311721761104482579936494",
"139384008962080267268602386710099234271",
"136135124634485320899446060054901900310",
"289002659891145344022660396593862677384",
"48619848544934364128056366835792962591",
"17399270253366887314832616289718845033",
"85530110898555858096741888130966498537",
"157592902291414109913674787743122528163",
"131813258107557863092345723158974952640",
"136990148100903220024894579152205620960",
"325539388195157626135104758799847475932",
"305506700244020877028419029244522423197",
"271366903355991008841625501196561127224",
"87533374115222047841924654782970141293",
"71576062193290989306630992866321551834",
"237152297563026333202164852481578788192",
"79142347360811686808639275467142433923",
"237469874781761932968372514611900243207",
"35894163888992830136615593610239932676"
]
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-b7606651",
"digest": {
"threshold": 0.9,
"line_hashes": [
"331473762518125757472384839031571060902",
"4158620335537989919269120992316136210",
"37536044244405383633242229082848527784",
"140335216194151808759673220052749435881"
]
},
"source": "https://github.com/facebook/hhvm/commit/55dc2e1650c1e79e67b7f0ef20e51cd2d504a4bb",
"target": {
"file": "hphp/runtime/version.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-c1ac316e",
"digest": {
"length": 912,
"function_hash": "145715691786455768944710079437504065661"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
"function": "unserializeThing"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-ccaf80e7",
"digest": {
"length": 534,
"function_hash": "321209806354837655737085289434882826264"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
"function": "unserializeMap"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-cf852ae4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"77006485962835594863492230187087547999",
"123957483544480932709462742203186491198",
"324681381068544546520157064078432699624",
"271967712181457776094316578430023955513",
"35746439978163504071255577375952994696",
"111701038126874625709433477144313928043",
"108014145752157512970262006775223792028",
"280451824540892538894098383718527695398",
"320881997547167147634222381860457807325",
"72015313253364208385273246189682791222",
"194135605952048905490590313043815329918",
"240497766763099138711501000616704534478",
"86388656772682628234950305282997416734",
"72015313253364208385273246189682791222",
"194135605952048905490590313043815329918",
"292435924164227485136877448263016733147",
"278787093222326728305751580044975795474",
"84139057522681045445478782799070479822",
"269264687466355196920710521358068180660",
"241969532403504386394671267598711269430",
"303070558977685776563107764204445381952",
"315109574514569473482783075745242172394",
"4832331348182810375331403790253801695",
"214966448798573362370817321954941242487",
"340026193505294365835262781562179029586",
"284307659605833258428869604414483006252",
"184991282801291342908007206010620625537",
"318734695729083989957630994407767660060",
"259743913818355546975421964218325780269",
"84538782393050635331448289889279151247",
"301644608005518607027712444785770546991",
"89648503310483090253605690973090250947"
]
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/ext_fb.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-d4e66146",
"digest": {
"length": 86,
"function_hash": "283275413755843508387453944612336227178"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
"function": "unserialize"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-d9284bff",
"digest": {
"length": 240,
"function_hash": "151197539678440144023640981284665104395"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
"function": "unserializeVector"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-e22db0a3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286093828909174357221555418457755310879",
"96311019219661911020751373701839576672",
"281574740350394436842520560909858709910",
"140335216194151808759673220052749435881"
]
},
"source": "https://github.com/facebook/hhvm/commit/d6af4b525b31c96526b2508642d58dbf5c7d496c",
"target": {
"file": "hphp/runtime/version.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1898-e7632df2",
"digest": {
"length": 255,
"function_hash": "328503010626063701618965234357099058815"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
"function": "unserializeList"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:52:56Z"
}
}
],
"modified": "2026-10-20T13:52:56.421726896Z",
"provider": "osv",
"references": [
"https://hhvm.com/blog/2020/06/30/security-update.html",
"https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-1898",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388347,
"published_at": "2021-03-11T01:15:14.177+00:00"
}