54 matches found
Reverb use after free vulnerability
There exists a use after free vulnerability in Reverb.Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...
PYSEC-2026-2452 Reverb use after free vulnerability
There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...
PT-2026-59121
There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...
Reverb use after free vulnerability
There exists a use after free vulnerability in Reverb.Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...
PYSEC-2026-1306 Reverb use after free vulnerability
There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...
The vulnerability of the unserialize() function in the Laravel Reverb WebSocket server allows a hacker to execute arbitrary code.
The vulnerability of the unserialize function in the Laravel Reverb WebSocket server is related to defects in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
CVE-2026-23524
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize function without restricting which classes can be instantiated, which leaves users vulnerable to...
Deserialization of Untrusted Data
Overview laravel/reverb is a provider of a real-time WebSocket communication backend for Laravel applications. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the unserialize function in PusherPubSubIncomingMessageHandler.php. An attacker can execute...
CVE-2026-23524
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize function without restricting which classes can be instantiated, which leaves users vulnerable to...
CVE-2026-23524
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize function without restricting which classes can be instantiated, which leaves users vulnerable to...
CVE-2026-23524
Laravel Reverb (laravel/reverb) prior to v1.7.0 is exposed to Remote Code Execution when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true) because data from the Redis channel is deserialized with PHP unserialize() without class restrictions. Affected versions are v1.6.3 and below; vulne...
CVE-2026-23524 Laravel Redis Horizontal Scaling Insecure Deserialization
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize function without restricting which classes can be instantiated, which leaves users vulnerable to...
CVE-2026-23524 Laravel Redis Horizontal Scaling Insecure Deserialization
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize function without restricting which classes can be instantiated, which leaves users vulnerable to...
CVE-2026-23524 Laravel Redis Horizontal Scaling Insecure Deserialization
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize function without restricting which classes can be instantiated, which leaves users vulnerable to...
GHSA-M27R-M6RX-MHM4 Laravel Redis Horizontal Scaling Insecure Deserialization
Impact This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled REVERBSCALINGENABLED=true. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication. With horizontal scaling enabled, Reverb...
Laravel Redis Horizontal Scaling Insecure Deserialization
Impact This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled REVERBSCALINGENABLED=true. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication. With horizontal scaling enabled, Reverb...
PT-2026-3792
Name of the Vulnerable Software and Affected Versions Laravel Reverb versions 1.6.3 and below Description Laravel Reverb, a real-time WebSocket communication backend for Laravel applications, has an issue where it passes data from the Redis channel directly into PHP’s unserialize function without...
CVE-2026-23524: Deserialization of Untrusted Data
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize function without restricting which classes can be instantiated, which leaves users vulnerable to...
Laravel Reverb code issue vulnerabilities
Laravel Reverb is a library open sourced from The Laravel Framework. It brings real-time WebSocket communication to Laravel applications. Versions of Laravel Reverb 1.6.3 and earlier have code vulnerabilities; these vulnerabilities stem from the direct transmission of data to the deserialization...
