CVE-2016-6873 in Facebook HHVM
Summary
by MITRE
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/13/2025
The vulnerability identified as CVE-2016-6873 represents a critical self-recursion issue within the compact functionality of Facebook HHVM version 3.15.0 and earlier. This flaw exists in the virtual machine's handling of recursive operations during code compilation and execution phases. The vulnerability manifests when the system encounters self-referential constructs within compacted code segments, creating infinite recursive loops that can consume excessive system resources and potentially lead to system instability. The unspecified impact vector indicates that the exact consequences of exploitation remain partially unclear, though the nature of self-recursion typically suggests denial of service or resource exhaustion scenarios.
The technical implementation of this vulnerability stems from inadequate recursion depth checking within HHVM's code optimization routines. When the virtual machine processes compacted code containing self-referential patterns, the system fails to properly detect and terminate recursive execution paths, leading to unbounded resource consumption. This behavior aligns with CWE-674, which addresses uncontrolled recursion in software systems, and demonstrates how improper handling of recursive data structures can lead to system-level failures. The compact operation in HHVM is designed to optimize memory usage and execution speed by consolidating code segments, but this optimization process becomes a security risk when it fails to account for self-referential constructs.
The operational impact of this vulnerability extends beyond simple denial of service scenarios, as it can potentially allow attackers to consume system resources at an exponential rate, leading to complete system exhaustion. Attackers could leverage this weakness by crafting malicious code that triggers the self-recursion pattern, causing the HHVM process to consume all available memory or CPU cycles. This creates a potential vector for resource exhaustion attacks that could affect web applications running on affected systems. The vulnerability's presence in a widely used virtual machine platform like HHVM means that numerous web applications and services could be impacted, particularly those relying on Facebook's PHP runtime environment. Additionally, the attack surface expands to include any system where HHVM is used for PHP execution, potentially affecting hosting providers and cloud environments that depend on this technology.
Mitigation strategies for CVE-2016-6873 primarily involve upgrading to HHVM version 3.15.0 or later, where the self-recursion handling has been properly addressed. System administrators should implement monitoring solutions to detect unusual resource consumption patterns that might indicate exploitation attempts. The fix typically involves implementing proper recursion depth limits and stack overflow protection mechanisms within the compact operation routines. Organizations should also consider implementing runtime restrictions and resource limits on HHVM processes to prevent complete system exhaustion. From an ATT&CK framework perspective, this vulnerability maps to techniques involving resource exhaustion and denial of service, specifically targeting the execution environment rather than application logic. Network segmentation and process isolation can help limit the potential impact of exploitation, while regular security assessments should verify that all HHVM instances are properly updated and monitored for similar recursion-related vulnerabilities.