Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2016-1000109

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive).

CVSS 5.3 · MediumBuzz score 17.5

Buzz score

Why this CVE is surfacing

Buzz score total 17.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 11.0 · diversity 6.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
11.0
2 evidence mentions in the snapshot
Diversity score
6.5
2 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
2 source links · newest first
  • Chances are good … that you’re already infectedCSO Online

    Depending on which of the many surveys on this topic you see, network breaches typically go undetected for an average of somewhere between 100 and 200 days. Since some organizations are faster and better at detection than others, that means that some undetected breaches last much longer than that. If your organization does not have […]

    newswww.csoonline.comJul 11, 2017, 6:51 PM
  • Old HTTPoxy Flaw Exposes Web Applications to AttacksSecurityWeek

    Researchers discovered that a vulnerability whose existence has been known for 15 years could affect many web applications, allowing malicious actors to launch man-in-the-middle (MitM) attacks.

    newswww.securityweek.comJul 19, 2016, 11:18 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-62433

    Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain oper…

    CVSS 7.3 · High
    3 mentions
  • CVE-2026-64775

    A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe…

    CVSS 9.8 · Critical
    7 mentions
  • CVE-2026-44434

    Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection t…

    CVSS 5.3 · Medium
    2 mentions
  • CVE-2026-54777

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-…

    CVSS 6.5 · Medium
    5 mentions
  • CVE-2026-54409

    A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authe…

    CVSS 7.5 · High
    1 mention
  • CVE-2026-54279

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later wit…

    CVSS 1.3 · Low
    2 mentions