Is CVE-2026-119723 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119723 being exploited in the wild.

How severe is CVE-2026-119723?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Meta HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.

Is there a fix for CVE-2026-119723?

Yes: fixed in 23c061f4e804a51badd5f85227e65185651253b5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119723 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119723?

Check whether you run Meta HHVM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119723: HHVM denial of service in request variable parsing

CVE-2026-119723 · Severity: info · Published 2026-11-11

HHVM is a PHP runtime engine used to execute web applications. An unauthenticated attacker can send a specially crafted GET or POST request that crashes the HHVM process before the application code runs, causing a complete service outage.

Vendors: Meta.

Quick answers

Is CVE-2026-119723 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119723 being exploited in the wild.
How severe is CVE-2026-119723?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Meta HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.
Is there a fix for CVE-2026-119723?: Yes: fixed in 23c061f4e804a51badd5f85227e65185651253b5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119723 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119723?: Check whether you run Meta HHVM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 23c061f4e804a51badd5f85227e65185651253b5

Technical details

HHVM failed to validate success when appending nested arrays during request variable parsing (query strings and form parameters), leading to a null pointer dereference or memory safety issue in the request handling path. A remote, unauthenticated attacker can trigger this via a malformed HTTP request, causing the server process to crash before application code execution. The fix is available in commit 23c061f4e804a51badd5f85227e65185651253b5.

Affected products

Meta HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.