CVE-2021-3007

CVE-2021-3007 is a critical-severity vulnerability in Getlaminas Laminas-http with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 75% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-502.

Key facts

Description

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized

Frequently asked questions

What is CVE-2021-3007?
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
How severe is CVE-2021-3007?
CVE-2021-3007 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-3007 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 75% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-3007?
CVE-2021-3007 primarily affects Getlaminas Laminas-http. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-3007?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2021-3007 published?
CVE-2021-3007 was published on 2021-01-04 and last updated on 2026-06-17.

References

Affected products (2)

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →