# CVE-2026-119723: HHVM denial of service in request variable parsing

Source: https://junglewise.ai/threats/cve-2026-119723-when-parsing-request-variables-such-as-query-string-and-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-119723 · Severity: info · Published 2026-11-11

HHVM is a PHP runtime engine used to execute web applications. An unauthenticated attacker can send a specially crafted GET or POST request that crashes the HHVM process before the application code runs, causing a complete service outage.

Vendors: [Meta](https://junglewise.ai/threats/vendors/meta).

## Quick answers

**Is CVE-2026-119723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119723 being exploited in the wild.

**How severe is CVE-2026-119723?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Meta HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5.

**Is there a fix for CVE-2026-119723?** Yes: fixed in 23c061f4e804a51badd5f85227e65185651253b5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119723 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119723?** Check whether you run Meta HHVM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 23c061f4e804a51badd5f85227e65185651253b5

## Technical details

HHVM failed to validate success when appending nested arrays during request variable parsing (query strings and form parameters), leading to a null pointer dereference or memory safety issue in the request handling path. A remote, unauthenticated attacker can trigger this via a malformed HTTP request, causing the server process to crash before application code execution. The fix is available in commit 23c061f4e804a51badd5f85227e65185651253b5.

## Affected products

- Meta HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5](https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5)
- [https://www.facebook.com/security/advisories/cve-2026-119723](https://www.facebook.com/security/advisories/cve-2026-119723)