Critical
Security advisory
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-3557
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:34 UTC · Revision 1
Source evidence
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
osv:CVE-2019-3557
Complete source record
{
"id": "2ad4dfd3f5b5cf4b9e3db6a65d0e77ece32710efa9648a8dbe19a5b46dec24f5",
"url": "https://osv.dev/vulnerability/CVE-2019-3557",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-3557",
"summary": "The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).",
"evidence": "osv:CVE-2019-3557",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-3557",
"aliases": [
"CVE-2019-3557"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebook/hhvm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "b14f761969e2ce2b52d7e49e40fa6c58bf43e477"
},
{
"introduced": "f0ad4879d6bee987a31c543ee57cc69b3741416b"
},
{
"last_affected": "68dd840917c9051225b38206fa61791bb68767fb"
},
{
"fixed": "6e4dd9ec3f14b48170fc45dc9d13a3261765f994"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.27.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.28.0"
},
{
"last_affected": "3.30.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "6e4dd9ec3f14b48170fc45dc9d13a3261765f994"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"HHVM-3.30.0",
"HHVM-3.27.4",
"HHVM-3.27.3",
"HHVM-3.27.2",
"HHVM-3.27.1",
"HHVM-3.27.0",
"gcc-4.6",
"HPHP-2.1.0",
"src-hphp",
"pre-hhvm"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3557.json",
"vanir_signatures": [
{
"id": "CVE-2019-3557-43cc3ee9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"142108827713512514436185405057893135105",
"269656250916374553211667901320829428383",
"319612009202422336968135164533114029828",
"15002152957258456447109582021990837697"
]
},
"source": "https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994",
"target": {
"file": "hphp/runtime/base/output-file.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-3557-55b6d914",
"digest": {
"length": 121,
"function_hash": "12047624258055674249961091365408552516"
},
"source": "https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994",
"target": {
"file": "hphp/runtime/base/output-file.cpp",
"function": "OutputFile::readImpl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-3557-a05c634b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"110901687410337669414477894623879298352",
"95572666697477733803261616521873614957",
"106358059622253155722317322929847808364",
"122347618177407082596295890497230634246"
]
},
"source": "https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994",
"target": {
"file": "hphp/runtime/ext/bz2/bz2-file.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-3557-bb1a0814",
"digest": {
"length": 255,
"function_hash": "22265091904922056449492719171830689508"
},
"source": "https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994",
"target": {
"file": "hphp/runtime/ext/bz2/bz2-file.cpp",
"function": "BZ2File::readImpl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:55:00Z"
}
}
],
"modified": "2026-10-20T13:55:00.507900394Z",
"provider": "osv",
"references": [
"https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html",
"https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-3557",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388371,
"published_at": "2019-01-15T22:29:00.377+00:00"
}