CVE-2018-6337: Facebook Folly

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.

Affected products

• Facebook Folly: from 2017.12.11.00, up to and including 2018.08.09.00
• Facebook Hhvm: from 3.26, before 3.26.3 (fixed in 3.26.3)

Published 2018-12-31. Last modified 2026-06-17.