CVE-2016-6873
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified...
CVE-2016-6873 is a critical vulnerability (CVSS 9.8) in Facebook Hhvm, published February 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. No source names a fixed version.
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
CVE-2016-6873- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
CVE-2016-6873- Updated
- 2026-11-02
EUVDEUVD-2016-7758 No score
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
EUVD-2016-7758- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hj8w-h393-6h4r
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified...
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
GHSA-hj8w-h393-6h4r- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
CVE-2016-6873- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-6873
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
UBUNTU-CVE-2016-6873- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hhvmUbuntu:16.04:LTS |
All versions, plus listed versions 3.11.0+dfsg-13.11.1+dfsg-13.11.1+dfsg-1ubuntu1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2016/08/11/1
github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e
nvd.nist.gov/vuln/detail/CVE-2016-6873
ubuntu.com/security/CVE-2016-6873
cve.org/CVERecord?id=CVE-2016-6873