CVE-2021-29476
Insecure Deserialization of untrusted data in rmccue/requests
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Insecure Deserialization of untrusted data in rmccue/requests
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
- Record
CVE-2021-29476- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2021-0762
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
- Record
EUVD-2021-0762- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-52qp-jpq7-6c54
Insecure Deserialization of untrusted data in rmccue/requests
Impact
Unserialization of untrusted data.
Patches
The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
References
Publications about the vulnerability:
- https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress
- https://github.com/ambionics/phpggc/issues/52
- https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/
- https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf
- https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
- https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf
- https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f
Originally fixed in WordPress 5.5.2:
- https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3
- https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
Related Security Advisories:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28032
- https://nvd.nist.gov/vuln/detail/CVE-2020-28032
Notification to the Requests repo including a fix in:
For more information
If you have any questions or comments about this advisory:
- Open an issue in Request
- Record
GHSA-52qp-jpq7-6c54- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
- Record
CVE-2021-29476- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
- Record
CVE-2021-29476- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-29476
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
- Record
DEBIAN-CVE-2021-29476- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-52qp-jpq7-6c54
Insecure Deserialization of untrusted data in rmccue/requests
Impact
Unserialization of untrusted data.
Patches
The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
References
Publications about the vulnerability:
- https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress
- https://github.com/ambionics/phpggc/issues/52
- https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/
- https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf
- https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
- https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf
- https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f
Originally fixed in WordPress 5.5.2:
- https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3
- https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
Related Security Advisories:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28032
- https://nvd.nist.gov/vuln/detail/CVE-2020-28032
Notification to the Requests repo including a fix in:
For more information
If you have any questions or comments about this advisory:
- Open an issue in Request
- Record
GHSA-52qp-jpq7-6c54- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-29476
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
- Record
UBUNTU-CVE-2021-29476- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rmccue/requestsPackagist |
1.6.0 up to 1.8.0 | 1.8.0 |
wordpressDebian:12 |
before 5.5.3+dfsg1-1 | 5.5.3+dfsg1-1 |
wordpressDebian:13 |
before 5.5.3+dfsg1-1 | 5.5.3+dfsg1-1 |
wordpressDebian:14 |
before 5.5.3+dfsg1-1 | 5.5.3+dfsg1-1 |
rmccue/requestsPackagist |
1.6.0 up to 1.8.0, plus listed versions v1.6.0v1.6.1v1.7.0 |
1.8.0 |
wordpressUbuntu:16.04:LTS |
All versions, plus listed versions 4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1 |
None known |
wordpressUbuntu:18.04:LTS |
All versions, plus listed versions 4.8.2+dfsg-24.8.3+dfsg-14.9.1+dfsg-14.9.2+dfsg-14.9.4+dfsg-14.9.5+dfsg1-1 |
None known |
wordpressUbuntu:20.04:LTS |
All versions, plus listed versions 5.2.2+dfsg1-15.2.4+dfsg1-15.3.2+dfsg1-15.3.2+dfsg1-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29476 is a critical vulnerability (CVSS 9.8) in Psf Requests, published April 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in rmccue/requests 1.8.0.
References
github.com/WordPress/Requests/security/advisories/GHSA-52qp-jpq7-6c54
nvd.nist.gov/vuln/detail/CVE-2021-29476
2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf
Show 11 moreShow less
blog.detectify.com/2019/07/23/improving-wordpress-plugin-security
cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress
i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf
medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066
wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release
security-tracker.debian.org/tracker/CVE-2021-29476
ubuntu.com/security/CVE-2021-29476
cve.org/CVERecord?id=CVE-2021-29476