CVE-2018-6332: facebook hhvm Uncontrolled Resource Consumption
CVSS: 5.9v3.1MediumModified
AliasesUBUNTU-CVE-2018-6332
Published 03-12-2018Last modified 06-05-2025
Vulnerability summary
CVE-2018-6332 is a medium (CVSS 5.9) Uncontrolled Resource Consumption vulnerability in facebook hhvm. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities.
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)EPSS score
1.09%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 03-12-2018PublishedVulnerability first disclosed.
- 06-05-2025Last modifiedVulnerability information updated.
Description
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This affects all supported versions of HHVM (3.24.3 and 3.21.7 and below) when using the proxygen server to handle HTTP2 requests.
CVSS metrics
6 scores · 3 sources · 3 versionsMedium 5.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.9Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.09% on 19-09-2026
19-09-202619-10-2026
EPSS score1.09%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-19Data Processing ErrorsWeaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Affected systems
Facebook1 product
- hhvm3.24.4 | ≥ 3.22.0, < unspecified | 3.21.8 | ≥ unspecified, < 3.21.8 | ≤ 3.21.7 | 3.24.3
Ubuntu1 product
- hhvmAll versions (No fix recorded)
2 vendors · 2 products