CVE-2018-6332

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This affects all supported versions of HHVM (3.24.3 and 3.21.7 and below) when using the proxygen server to handle HTTP2 requests.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-19

Affected software

VendorProductVersions
FacebookHHVM3.24.4; >= 3.22.0, < unspecified; 3.21.8; >= unspecified, < 3.21.8

References

Timeline

Published
Dec 3, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-63339.8The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a maliciCVE-2018-63349.8Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly CVE-2018-63357.5A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. TCVE-2018-63367.8An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing CVE-2018-63377.5folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked childCVE-2018-63399.8When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An offCVE-2018-63408.1The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached CVE-2018-63416.1React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That CVE-2018-63429.8react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoCVE-2018-63437.5Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsiCVE-2018-63447.5A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used CVE-2018-63459.8The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal