CVE-2018-6335

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. This affects all supported versions of HHVM (3.25.2, 3.24.6, and 3.21.10 and below) when using the proxygen server to handle HTTP2 requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-20

Affected software

Vendor	Product	Versions
Facebook	HHVM	3.25.3; 3.25.0; 3.24.7; 3.22.0; 3.21.11; >= unspecified, < 3.21.11

References

https://github.com/facebook/hhvm/commit/4cb57dd753a339654ca464c139db9871fe961d56Patch, Third Party Advisory
https://hhvm.com/blog/2018/05/04/hhvm-3.25.3.htmlVendor Advisory
https://github.com/facebook/hhvm/commit/4cb57dd753a339654ca464c139db9871fe961d56Patch, Third Party Advisory
https://hhvm.com/blog/2018/05/04/hhvm-3.25.3.htmlVendor Advisory

Timeline

Published: Dec 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-63367.8An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing CVE-2018-63377.5folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked child CVE-2018-63399.8When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off CVE-2018-63408.1The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached CVE-2018-63416.1React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That CVE-2018-63429.8react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an edito CVE-2018-63437.5Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsi CVE-2018-63447.5A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used CVE-2018-63459.8The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal CVE-2018-63467.5A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This a CVE-2018-63477.5An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior t CVE-2018-63499.8When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overfl