VULNERABILITY INTELLIGENCE
CVE-2019-11936
CVSS score9.8 CRITICAL
EPSS probability1.48%
CISA KEVNot currently listed
Published2019-12-04
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
Weakness classification
- CWE-626: Null Byte Interaction Error (Poison Null Byte)
Primary references
- cve-assign@fb.com — Patch, Third Party Advisory
- cve-assign@fb.com — Vendor Advisory
- cve-assign@fb.com — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory