Laminas Project laminas-http - Remote Code Execution

Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...

CVE-2021-3007-docker-poc

CVE-2021-3007 — Laminas/Zend HTTP Deserialization RCE This repository contains a fully reproducible Proof-of-Concept and Nuclei exploit template for CVE-2021-3007, a critical PHP deserialization vulnerability in Zend\Http\Response\Stream laminas-http Nuclei exploit template ├── docker-compose.yml...

zend-crypt

zend-crypt Repository abandoned 2019-12-31 This repository has moved to laminas/laminas-crypt. Zend\Crypt provides support of some cryptographic tools. Some of the available features are: encrypt-then-authenticate using symmetric ciphers the authentication step is provided using HMAC;...

CLSA-2026-1789456930 TuxCare security update for laminas/laminas-diactoros (2 CVEs)

TuxCare rebuilt laminas/laminas-diactoros to address 2 CVEs. Fixed in 1.8.7p2-1+tuxcare...

PT-2026-98449

TuxCare rebuilt laminas/laminas-diactoros to address 2 CVEs. Fixed in 1.8.7p2-1+tuxcare...

CLSA-2026-1783645389 TuxCare security update for laminas/laminas-http (1 CVE)

TuxCare rebuilt laminas/laminas-http to address 1 CVE. Fixed in 2.5.6-p1+tuxcare...

CLSA-2026-1781052745 TuxCare security update for laminas/laminas-diactoros (1 CVE)

TuxCare rebuilt laminas/laminas-diactoros to address 1 CVE. Fixed in 2.22.0-p1+tuxcare...

PT-2026-74999

TuxCare rebuilt laminas/laminas-diactoros to address 1 CVE. Fixed in 2.22.0-p1+tuxcare...

PT-2026-75352

TuxCare rebuilt laminas/laminas-http to address 1 CVE. Fixed in 2.5.6-p1+tuxcare...

Exploit for Deserialization of Untrusted Data in Getlaminas Laminas-Http

CVE-2021-3007 Vulnerable Test Environment !Dockerhttps://...

Exploit for Deserialization of Untrusted Data in Getlaminas Laminas-Http

CVE-2021-3007 — Laminas/Zend HTTP Deserialization RCE ==========...

EUVD-2022-0630

Malicious code in bioql PyPI...

EUVD-2022-6288

Malicious code in bioql PyPI...

EUVD-2023-1431

Malicious code in bioql PyPI...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

[SECURITY] Fedora 38 Update: php-laminas-diactoros2-2.25.2-1.fc38

A PHP package containing implementations of the accepted PSR-7 HTTP message interfaces 1, as well as a "server" implementation similar to node's http.Server 2. Documentation: https://docs.laminas.dev/laminas-diactoros/ Autoloader: /usr/share/php/Laminas/Diactoros2/autoload.php 1...

Fedora 38 : php-laminas-diactoros2 (2023-8cf8786a16)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8cf8786a16 advisory. Version 2.25.2 This release provides a patch for CVE-2023-29530 / GHSA-xv3h-4844-9h36 / LP2023-01. Tenable has extracted the preceding description block...

HTTP Multiline Header Termination

Impact Affected versions of Laminas Diactoros accepted a single line feed LF / \n character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due ...

GHSA-XV3H-4844-9H36 HTTP Multiline Header Termination

Impact Affected versions of Laminas Diactoros accepted a single line feed LF / \n character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due ...

CVE-2023-29530

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value...