CVE-2016-6875
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified...
CVE-2016-6875 is a critical vulnerability (CVSS 9.8) in Facebook Hhvm, published February 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. No source names a fixed version.
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
CVE-2016-6875- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
CVE-2016-6875- Updated
- 2026-11-02
EUVDEUVD-2016-7760 No score
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
EUVD-2016-7760- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hw97-vcq7-qrhf
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified...
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
GHSA-hw97-vcq7-qrhf- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
CVE-2016-6875- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-6875
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- Record
UBUNTU-CVE-2016-6875- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hhvmUbuntu:16.04:LTS |
All versions, plus listed versions 3.11.0+dfsg-13.11.1+dfsg-13.11.1+dfsg-1ubuntu1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2016/08/11/1
github.com/facebook/hhvm/commit/1888810e77b446a79a7674784d5f139fcfa605e2
nvd.nist.gov/vuln/detail/CVE-2016-6875
ubuntu.com/security/CVE-2016-6875
cve.org/CVERecord?id=CVE-2016-6875