Threats tagged 'ghsa-cr6x-jqxp-2v2p'

HHVM versions prior to commit 23c061f4e804a51badd5f85227e65185651253b5 contain a vulnerability in request variable parsing. Specifically, when handling query-string and form parameters, HHVM did not verify that appending a nested array succeeded before further processing. This flaw allows a remote, unauthenticated attacker to send crafted GET or POST requests that cause the HHVM server process to crash before application code execution, resulting in denial of service.