What’s Vulnerable › Vulnerabilities

CVE-2016-1000109

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-19 · updated 2026-06-17
• Weakness: CWE-665

Description

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive).

Affected products

• Facebook HHVM: before 3.9.6; from 3.10.0 through 3.12.4; from 3.13.0 through 3.14.2 — fixed in 3.9.6

How to fix

Upgrade to a fixed version: Facebook HHVM 3.9.6. Check the vendor advisory for mitigations.

References

• https://github.com/facebook/hhvm/commit/423b4b719afd5ef4e6e19d8447fbf7b6bc0d0a25
• https://httpoxy.org/
• https://www.facebook.com/security/advisories/cve-2016-1000109
• https://github.com/facebook/hhvm/commit/423b4b719afd5ef4e6e19d8447fbf7b6bc0d0a25
• https://httpoxy.org/
• https://www.facebook.com/security/advisories/cve-2016-1000109

Get alerted when CVE-2016-1000109 or the next vulnerability affects your stack