The array_*_recursive functions in Facebook HHVM prior to 3.15.0 allows malicious users to have unspecified impact via unknown vectors, related to recursion.
facebook hhvm