CVE-2018-6337

HIGH 7.5CVE-2018-6337 · Published 31/12/2018 · updated 17/06/2026

In short

CVE-2018-6337 is a HIGH (CVSS 7.5) vulnerability affecting folly (facebook), hhvm (facebook).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.2% of all vulnerabilities.
Fix: update to 3.26.3 or later.

Package	Affected versions	Patched versions
folly facebook	`≥ 2017.12.11.00, ≤ 2018.08.09.00`	No fix yet
hhvm facebook	`≥ 3.26, < 3.26.3`	`3.26.3`

Description

folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.

References

facebook/folly commit 8e927ee · Patch
facebook/hhvm commit e2d10a1 · Patch
hhvm.com/blog/2018/05/24/hhvm-3.26.3.html · Release Notes

More vulnerabilities in folly

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free