CVE-2020-1898

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-189809.8Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.CVE-2020-189825.4Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.CVE-2020-189846.1A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 al CVE-2020-189856.1An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website o CVE-2020-18997.5The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed ar CVE-2020-189986.1Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/CVE-2020-189996.1Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/submit-articles'.CVE-2020-19009.8When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting CVE-2020-190006.1Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simi CVE-2020-190019.8Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'si CVE-2020-190026.1Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componen CVE-2020-190035.3An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances u