High
Security advisory
Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-1888
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:34 UTC · Revision 1
Source evidence
Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
osv:CVE-2020-1888
Complete source record
{
"id": "4e05cc3bf003f5e6a6f9d2b205cfc4ee85c46bbfd04825f2a333e2639cdd87fd",
"url": "https://osv.dev/vulnerability/CVE-2020-1888",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-1888",
"summary": "Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.",
"evidence": "osv:CVE-2020-1888",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-1888",
"aliases": [
"CVE-2020-1888"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebook/hhvm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "75ea519eea0fe679c4efd3af377f5250e54b6388"
},
{
"introduced": "0abb3b0c92e938bb7dac2d0c1603c5866e2a035b"
},
{
"last_affected": "639027f066c5db1b684e400924b62dc1c803fda9"
},
{
"introduced": "8df1dd7ead93f50388145dd8d7734a69204b50a7"
},
{
"last_affected": "543f523b787b6fe1415b2cbc63a0d1965249fb0c"
},
{
"introduced": "1b6f9e26323e5c56090d17bd714cc2b73422760b"
},
{
"last_affected": "9c6698440803448f5d8cf318d23d934ee473a54f"
},
{
"fixed": "b3679121bb3c7017ff04b4c08402ffff5cf59b13"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.8.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.9.0"
},
{
"last_affected": "4.32.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.33.0"
},
{
"last_affected": "4.38.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.39.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.39.0"
},
{
"last_affected": "4.39.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.40.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.40.0"
},
{
"last_affected": "4.40.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.41.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.41.0"
},
{
"last_affected": "4.41.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.42.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.42.0"
},
{
"last_affected": "4.42.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.43.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.43.0"
},
{
"last_affected": "4.43.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.44.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.44.0"
},
{
"last_affected": "4.44.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.45.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.45.0"
},
{
"last_affected": "4.45.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "b3679121bb3c7017ff04b4c08402ffff5cf59b13"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"4.39.0",
"4.40.0",
"4.41.0",
"4.42.0",
"4.43.0",
"4.44.0",
"4.45.0",
"nightly-2020.02.20",
"nightly-2020.02.19",
"HHVM-4.45.0",
"nightly-2020.02.18",
"nightly-2020.02.17",
"nightly-2020.02.16",
"nightly-2020.02.15",
"nightly-2020.02.14",
"nightly-2020.02.13",
"nightly-2020.02.12",
"nightly-2020.02.11",
"nightly-2020.02.10",
"nightly-2020.02.09",
"nightly-2020.02.08",
"nightly-2020.02.07",
"nightly-2020.02.06",
"nightly-2020.02.05",
"nightly-2020.02.04",
"nightly-2020.02.03",
"nightly-2020.02.02",
"nightly-2020.02.01",
"nightly-2020.01.31",
"nightly-2020.01.30",
"nightly-2020.01.29",
"nightly-2020.01.28",
"nightly-2020.01.27",
"nightly-2020.01.26",
"nightly-2020.01.25",
"nightly-2020.01.24",
"nightly-2020.01.23",
"nightly-2020.01.22",
"nightly-2020.01.21",
"nightly-2020.01.20",
"nightly-2020.01.19",
"nightly-2020.01.18",
"nightly-2020.01.17",
"nightly-2020.01.16",
"nightly-2020.01.15",
"nightly-2020.01.14",
"nightly-2020.01.13",
"nightly-2020.01.12",
"nightly-2020.01.11",
"nightly-2020.01.10",
"nightly-2020.01.09",
"nightly-2020.01.08",
"nightly-2020.01.07",
"nightly-2020.01.06",
"nightly-2020.01.05",
"nightly-2020.01.04",
"nightly-2020.01.03",
"HHVM-4.38.0",
"nightly-2020.01.02",
"nightly-2020.01.01",
"nightly-2019.12.31",
"nightly-2019.12.30",
"nightly-2019.12.29",
"nightly-2019.12.28",
"nightly-2019.12.27",
"nightly-2019.12.26",
"nightly-2019.12.25",
"nightly-2019.12.24",
"nightly-2019.12.23",
"nightly-2019.12.22",
"nightly-2019.12.21",
"nightly-2019.12.20",
"nightly-2019.12.19",
"nightly-2019.12.18",
"nightly-2019.12.17",
"nightly-2019.12.16",
"nightly-2019.12.15",
"nightly-2019.12.14",
"nightly-2019.12.13",
"nightly-2019.12.12",
"nightly-2019.12.11",
"nightly-2019.12.09",
"nightly-2019.12.10",
"nightly-2019.12.08",
"nightly-2019.12.07",
"nightly-2019.12.06",
"nightly-2019.12.05",
"nightly-2019.12.04",
"nightly-2019.12.03",
"nightly-2019.12.02",
"nightly-2019.12.01",
"nightly-2019.11.30",
"nightly-2019.11.29",
"nightly-2019.11.28",
"nightly-2019.11.27",
"nightly-2019.11.26",
"nightly-2019.11.25",
"nightly-2019.11.24",
"nightly-2019.11.23",
"nightly-2019.11.22",
"nightly-2019.11.21",
"nightly-2019.11.20",
"nightly-2019.11.19",
"HHVM-4.32.0",
"nightly-2019.11.18",
"nightly-2019.11.17",
"nightly-2019.11.16",
"nightly-2019.11.15",
"nightly-2019.11.14",
"nightly-2019.11.13",
"nightly-2019.11.12",
"nightly-2019.11.11",
"nightly-2019.11.10",
"nightly-2019.11.09",
"nightly-2019.11.08",
"nightly-2019.11.07",
"nightly-2019.11.06",
"nightly-2019.11.05",
"nightly-2019.11.04",
"nightly-2019.11.03",
"nightly-2019.11.02",
"nightly-2019.11.01",
"nightly-2019.10.31",
"nightly-2019.10.30",
"nightly-2019.10.29",
"nightly-2019.10.28",
"nightly-2019.10.27",
"nightly-2019.10.26",
"HHVM-4.8.6",
"nightly-2019.10.25",
"nightly-2019.10.24",
"nightly-2019.10.23",
"nightly-2019.10.22",
"nightly-2019.10.21",
"nightly-2019.10.20",
"nightly-2019.10.19",
"nightly-2019.10.18",
"nightly-2019.10.17",
"nightly-2019.10.16",
"nightly-2019.10.15",
"nightly-2019.10.14",
"nightly-2019.10.13",
"nightly-2019.10.12",
"nightly-2019.10.11",
"nightly-2019.10.10",
"nightly-2019.10.09",
"nightly-2019.10.08",
"nightly-2019.10.07",
"nightly-2019.10.06",
"nightly-2019.10.05",
"nightly-2019.10.04",
"nightly-2019.10.03",
"nightly-2019.10.02",
"nightly-2019.10.01",
"nightly-2019.09.30",
"nightly-2019.09.29",
"nightly-2019.09.28",
"nightly-2019.09.27",
"nightly-2019.09.26",
"nightly-2019.09.25",
"nightly-2019.09.24",
"HHVM-4.8.5",
"nightly-2019.09.23",
"nightly-2019.09.22",
"nightly-2019.09.21",
"nightly-2019.09.20",
"nightly-2019.09.19",
"nightly-2019.09.18",
"nightly-2019.09.17",
"nightly-2019.09.16",
"nightly-2019.09.15",
"nightly-2019.09.14",
"nightly-2019.09.13",
"nightly-2019.09.12",
"nightly-2019.09.11",
"nightly-2019.09.10",
"nightly-2019.09.09",
"nightly-2019.09.08",
"nightly-2019.09.07",
"nightly-2019.09.06",
"nightly-2019.09.05",
"nightly-2019.09.04",
"HHVM-4.8.4",
"nightly-2019.09.03",
"nightly-2019.09.02",
"nightly-2019.09.01",
"nightly-2019.08.31",
"nightly-2019.08.30",
"nightly-2019.08.29",
"nightly-2019.08.28",
"nightly-2019.08.27",
"nightly-2019.08.26",
"nightly-2019.08.25",
"nightly-2019.08.24",
"nightly-2019.08.23",
"nightly-2019.08.22",
"nightly-2019.08.21",
"nightly-2019.08.20",
"nightly-2019.08.19",
"nightly-2019.08.18",
"nightly-2019.08.17",
"nightly-2019.08.16",
"nightly-2019.08.15",
"nightly-2019.08.14",
"HHVM-4.8.3",
"nightly-2019.08.13",
"nightly-2019.08.12",
"nightly-2019.08.11",
"nightly-2019.08.10",
"nightly-2019.08.09",
"nightly-2019.08.08",
"HHVM-4.8.2",
"nightly-2019.08.07",
"nightly-2019.08.06",
"nightly-2019.08.05",
"nightly-2019.08.04",
"nightly-2019.08.03",
"nightly-2019.08.02",
"nightly-2019.08.01",
"nightly-2019.07.31",
"nightly-2019.07.30",
"nightly-2019.07.29",
"nightly-2019.07.28",
"nightly-2019.07.27",
"nightly-2019.07.26",
"nightly-2019.07.25",
"nightly-2019.07.24",
"nightly-2019.07.23",
"nightly-2019.07.22",
"nightly-2019.07.21",
"nightly-2019.07.20",
"nightly-2019.07.19",
"nightly-2019.07.18",
"nightly-2019.07.17",
"nightly-2019.07.16",
"nightly-2019.07.15",
"nightly-2019.07.14",
"nightly-2019.07.13",
"nightly-2019.07.12",
"nightly-2019.07.11",
"nightly-2019.07.10",
"nightly-2019.07.09",
"nightly-2019.07.08",
"nightly-2019.07.07",
"nightly-2019.07.06",
"nightly-2019.07.05",
"nightly-2019.07.04",
"nightly-2019.07.03",
"nightly-2019.07.02",
"nightly-2019.07.01",
"nightly-2019.06.30",
"nightly-2019.06.29",
"nightly-2019.06.28",
"nightly-2019.06.27",
"nightly-2019.06.26",
"nightly-2019.06.25",
"nightly-2019.06.24",
"nightly-2019.06.23",
"nightly-2019.06.22",
"nightly-2019.06.21",
"nightly-2019.06.20",
"nightly-2019.06.19",
"nightly-2019.06.17",
"nightly-2019.06.18",
"nightly-2019.06.16",
"nightly-2019.06.15",
"nightly-2019.06.14",
"nightly-2019.06.13",
"nightly-2019.06.12",
"nightly-2019.06.11",
"nightly-2019.06.10",
"HHVM-4.8.1",
"nightly-2019.06.09",
"nightly-2019.06.08",
"nightly-2019.06.07",
"nightly-2019.06.06",
"nightly-2019.06.05",
"nightly-2019.06.04",
"HHVM-4.8.0",
"nightly-2019.06.03",
"nightly-2019.06.02",
"nightly-2019.06.01",
"nightly-2019.05.31",
"nightly-2019.05.30",
"nightly-2019.05.29",
"nightly-2019.05.28",
"nightly-2019.05.27",
"nightly-2019.05.26",
"nightly-2019.05.25",
"nightly-2019.05.24",
"nightly-2019.05.23",
"nightly-2019.05.22",
"nightly-2019.05.21",
"nightly-2019.05.20",
"nightly-2019.05.19",
"nightly-2019.05.18",
"nightly-2019.05.17",
"nightly-2019.05.16",
"nightly-2019.05.15",
"nightly-2019.05.14",
"nightly-2019.05.13",
"nightly-2019.05.12",
"nightly-2019.05.11",
"nightly-2019.05.10",
"nightly-2019.05.09",
"nightly-2019.05.08",
"nightly-2019.05.07",
"nightly-2019.05.06",
"nightly-2019.05.05",
"nightly-2019.05.04",
"nightly-2019.05.03",
"nightly-2019.05.02",
"nightly-2019.05.01",
"nightly-2019.04.30",
"nightly-2019.04.29",
"nightly-2019.04.28",
"nightly-2019.04.27",
"nightly-2019.04.26",
"nightly-2019.04.25",
"nightly-2019.04.24",
"nightly-2019.04.22",
"nightly-2019.04.23",
"nightly-2019.04.21",
"nightly-2019.04.20",
"nightly-2019.04.19",
"nightly-2019.04.18",
"nightly-2019.04.17",
"nightly-2019.04.16",
"nightly-2019.04.15",
"nightly-2019.04.14",
"nightly-2019.04.13",
"nightly-2019.04.12",
"nightly-2019.04.11",
"nightly-2019.04.10",
"nightly-2019.04.09",
"nightly-2019.04.08",
"nightly-2019.04.07",
"nightly-2019.04.06",
"nightly-2019.04.05",
"nightly-2019.04.04",
"nightly-2019.04.03",
"nightly-2019.04.02",
"nightly-2019.04.01",
"nightly-2019.03.31",
"nightly-2019.03.30",
"nightly-2019.03.29",
"nightly-2019.03.28",
"gcc-4.6",
"HPHP-2.1.0",
"src-hphp",
"pre-hhvm"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1888.json",
"vanir_signatures": [
{
"id": "CVE-2020-1888-5e4c2ef7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253300345033833824648681931010887940210",
"323252071051621740325063727887978820026",
"30092081122455680424502200720017557775",
"4694736965073798775260577777545583703",
"289483391976236989165392546243082264219",
"294574240356151962882517616397669921396",
"318621315425022735603688703224263581423",
"70885010345768735145357321360228283103",
"321190195641690808215972738970428636376",
"49091889793634698122077976024893724490"
]
},
"source": "https://github.com/facebook/hhvm/commit/b3679121bb3c7017ff04b4c08402ffff5cf59b13",
"target": {
"file": "hphp/runtime/ext/json/JSON_parser.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1888-ea8c35e1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94241718375072390049514553484705121889",
"202283354718075733938286784465843663220",
"328155670994027392479458866869178825570",
"140335216194151808759673220052749435881"
]
},
"source": "https://github.com/facebook/hhvm/commit/75ea519eea0fe679c4efd3af377f5250e54b6388",
"target": {
"file": "hphp/runtime/version.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:52:55Z"
}
}
],
"modified": "2026-10-20T13:52:55.277874419Z",
"provider": "osv",
"references": [
"https://hhvm.com/blog/2020/02/20/security-update.html",
"https://github.com/facebook/hhvm/commit/b3679121bb3c7017ff04b4c08402ffff5cf59b13"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-1888",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388345,
"published_at": "2020-03-03T15:15:11.883+00:00"
}