Critical
Security advisory
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-6873
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:11 UTC · Revision 1
Source evidence
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
osv:CVE-2016-6873
Complete source record
{
"id": "3c79e5f6226a3292bbe0f5599cf6606c30878e01b7eaa5be23fa2a2ec59a9b1b",
"url": "https://osv.dev/vulnerability/CVE-2016-6873",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-6873",
"summary": "Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.",
"evidence": "osv:CVE-2016-6873",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-6873",
"aliases": [
"CVE-2016-6873"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebook/hhvm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "c6bf714e6468213eed377527b431e9cd4cec1432"
},
{
"fixed": "e264f04ae825a5d97758130cf8eec99862517e7e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.14.5"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "e264f04ae825a5d97758130cf8eec99862517e7e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"HHVM-3.14.5",
"HHVM-3.14.4",
"HHVM-3.14.3",
"HHVM-3.14.2",
"HHVM-3.14.1",
"HHVM-3.14.0",
"gcc-4.6",
"HPHP-2.1.0",
"src-hphp",
"pre-hhvm"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6873.json",
"vanir_signatures": [
{
"id": "CVE-2016-6873-02e50422",
"digest": {
"length": 303,
"function_hash": "125610103184926962950582925333815305707"
},
"source": "https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e",
"target": {
"file": "hphp/runtime/ext/array/ext_array.cpp",
"function": "HHVM_FUNCTION"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-6873-04b4ae07",
"digest": {
"length": 796,
"function_hash": "85853746093120045721078706061501071445"
},
"source": "https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e",
"target": {
"file": "hphp/runtime/ext/array/ext_array.cpp",
"function": "php_array_merge_recursive"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-6873-6f317480",
"digest": {
"length": 223,
"function_hash": "146266446582745356990202896584287219025"
},
"source": "https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e",
"target": {
"file": "hphp/runtime/ext/array/ext_array.cpp",
"function": "couldRecur"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-6873-7c3b86f0",
"digest": {
"length": 872,
"function_hash": "328442204768296124416267005031122186472"
},
"source": "https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e",
"target": {
"file": "hphp/runtime/ext/array/ext_array.cpp",
"function": "php_array_replace_recursive"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-6873-a91737e7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97361547630027322574222647014124852281",
"78903862613093397262113004768607414511",
"76765149538626271068897607737099354073",
"321476246634189679197177953373852899976",
"248672525003541227847887461059484603905",
"195485375378949632513157155182160058284",
"71886400786605584585836567979641842149",
"338626650070849102615054970750623059441",
"86125372370983923170963321836882601909",
"289725860449185516231204320354585492073",
"257334469680627901587349474656674537328",
"154849570881591230381242151849890572849",
"326805423876088448169918127897408315408",
"337807628311309867437776118780534299514",
"312758995874743756866805394665251027946",
"98317148521411626441563381943965899622",
"39295752359109139992725667355539978079",
"101401039760345960202110396765246996862",
"217587960885088870813847440557907263039",
"229527666502967812146007611241585244051",
"15695188223898260009332610533408179547",
"75344745195936675426714391345725018353",
"126954964390694268661484508007218851362",
"272005485538011712676942871332506373561",
"287359401698848343517626337763810182055",
"238435803054599643781881065999149726119",
"136575586570090622231093315131856701782",
"87586029857131106200540775548874032624",
"272005485538011712676942871332506373561",
"287359401698848343517626337763810182055",
"238435803054599643781881065999149726119",
"136575586570090622231093315131856701782",
"87586029857131106200540775548874032624"
]
},
"source": "https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e",
"target": {
"file": "hphp/runtime/ext/array/ext_array.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-6873-d8b290bd",
"digest": {
"length": 355,
"function_hash": "190016695376741468043394676901712689603"
},
"source": "https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e",
"target": {
"file": "hphp/runtime/ext/array/ext_array.cpp",
"function": "HHVM_FUNCTION"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-6873-e16f98da",
"digest": {
"length": 437,
"function_hash": "23110508029818134001336601187523389830"
},
"source": "https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e",
"target": {
"file": "hphp/runtime/ext/array/ext_array.cpp",
"function": "compact"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:17:28Z"
}
}
],
"modified": "2026-10-20T13:17:28.596551692Z",
"provider": "osv",
"references": [
"https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2016-6873",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387456,
"published_at": "2017-02-17T17:59:01.077+00:00"
}