CVE-2016-6875 in Facebook HHVM
Summary
by MITRE
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/13/2025
The vulnerability identified as CVE-2016-6875 represents a critical infinite recursion flaw within the Web Distributed Data Exchange (WDDX) functionality of Facebook HHVM version 3.15.0 and earlier. This issue stems from improper handling of recursive data structures during WDDX serialization processes, creating a condition where the interpreter enters an endless loop when processing malformed input data. The vulnerability manifests in the way HHVM's WDDX implementation manages nested data structures, particularly when dealing with circular references or deeply nested objects that exceed normal processing limits. The flaw exists at the interpreter level within HHVM's data serialization engine, making it particularly dangerous as it can be triggered through various input vectors without requiring special privileges or authentication.
The technical exploitation of this vulnerability occurs when malicious input containing recursive data structures is processed through HHVM's WDDX functions, specifically those handling data serialization and deserialization operations. The recursion happens during the internal parsing of WDDX packets, where the interpreter fails to implement proper recursion depth limits or detection mechanisms. This allows attackers to craft specially formatted WDDX data that causes the HHVM process to consume excessive CPU resources and memory, ultimately leading to denial of service conditions. The vulnerability is classified under CWE-674 as "Uncontrolled Recursion" and aligns with ATT&CK technique T1499.302 for "Resource Exhaustion" as it can be leveraged to exhaust system resources through recursive processing. The impact is particularly severe in web applications where WDDX functionality is exposed to untrusted input, as it can be exploited to crash web servers or cause significant performance degradation.
The operational impact of CVE-2016-6875 extends beyond simple denial of service scenarios, as it can potentially be chained with other vulnerabilities to achieve more sophisticated attacks. When exploited in web applications, this vulnerability can cause complete service disruption, leading to availability issues that affect business operations and user experience. The vulnerability affects any system running HHVM versions prior to 3.15.0 that processes WDDX data, particularly web applications that utilize Facebook's HHVM runtime for PHP applications. Attackers can leverage this vulnerability through various means including crafted HTTP requests, file uploads containing malicious WDDX data, or API calls that process serialized data. The exploitation requires minimal privileges and can be automated, making it particularly dangerous in environments where HHVM is used to process untrusted user input. Organizations using HHVM in production environments should consider this vulnerability as a high-priority remediation target, especially in applications handling user-provided data or external API integrations that may process WDDX formatted data.
Mitigation strategies for CVE-2016-6875 primarily focus on upgrading to HHVM version 3.15.0 or later, which includes proper recursion depth limiting and enhanced input validation for WDDX operations. Additionally, organizations should implement input sanitization measures to validate and limit the complexity of data processed through WDDX functions, particularly when handling external or user-provided input. Network-level protections such as rate limiting and input filtering can help reduce the attack surface, while monitoring systems should be configured to detect unusual CPU or memory consumption patterns that may indicate exploitation attempts. Security teams should also consider implementing application firewalls or web application firewalls that can identify and block malicious WDDX data patterns. The vulnerability highlights the importance of proper recursion handling in interpreted languages and serves as a reminder of the critical need for robust input validation and resource management in server-side applications. Regular security assessments and vulnerability scanning should include checks for outdated HHVM versions, and organizations should maintain updated security patches for their runtime environments to prevent exploitation of similar recursion-based vulnerabilities.