CVE-2021-3007
Remote code execution in zendframework and laminas-http
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
- Record
CVE-2021-3007- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
- Record
CVE-2021-3007- Updated
- 2026-11-02
EUVDEUVD-2021-1428 No score
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
- Record
EUVD-2021-1428- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xx8f-qf9f-5fgw
Remote code execution in zendframework and laminas-http
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized.
- Record
GHSA-xx8f-qf9f-5fgw- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
- Record
CVE-2021-3007- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-xx8f-qf9f-5fgw
Remote code execution in zendframework and laminas-http
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized.
- Record
GHSA-xx8f-qf9f-5fgw- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1779151616 No score
TuxCare security update for zendframework/zend-http (1 CVE)
TuxCare rebuilt zendframework/zend-http to address 1 CVE. Fixed in 2.5.6-p1+tuxcare.
- Record
CLSA-2026-1779151616- Updated
- 2026-11-02
OSVCLSA-2026-1782867594 No score
TuxCare security update for zendframework/zendframework (1 CVE)
TuxCare rebuilt zendframework/zendframework to address 1 CVE. Fixed in 2.4.13-p1+tuxcare.
- Record
CLSA-2026-1782867594- Updated
- 2026-11-02
OSVCLSA-2026-1783645389 No score
TuxCare security update for laminas/laminas-http (1 CVE)
TuxCare rebuilt laminas/laminas-http to address 1 CVE. Fixed in 2.5.6-p1+tuxcare.
- Record
CLSA-2026-1783645389- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zendframework/zendframeworkPackagist |
through 3.0.0 | None known |
laminas/laminas-httpPackagist |
before 2.14.2 | 2.14.2 |
zendframework/zend-httpTuxCare:Packagist |
2.5.6 up to 2.5.6-p1+tuxcare | 2.5.6-p1+tuxcare |
zendframework/zendframeworkTuxCare:Packagist |
2.4.13 up to 2.4.13-p1+tuxcare | 2.4.13-p1+tuxcare |
laminas/laminas-httpTuxCare:Packagist |
2.5.6 up to 2.5.6-p1+tuxcare | 2.5.6-p1+tuxcare |
zendframework/zendframeworkPackagist |
through 3.0.0, plus listed versions 2.0.02.0.0beta42.0.0beta52.0.0rc12.0.0rc2 Show 45 moreShow less2.0.0rc32.0.0rc42.0.0rc52.0.0rc62.0.0rc72.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.0 |
None known |
laminas/laminas-httpPackagist |
before 2.14.2, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.52.0.62.0.72.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.10.02.10.12.11.02.11.12.11.22.11.32.12.02.13.02.14.02.14.12.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.9 |
2.14.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Laminas Project laminas-http - Remote Code Execution | |
| PoC in GitHub | KrE80r/cve-2021-3007-vulnerable | 2025-12-05 |
| PoC in GitHub | Vulnmachines/ZF3_CVE-2021-3007 | 2021-05-18 |
| PoC in GitHub | yunus-a1i/CVE-2021-3007-docker-poc | 2025-12-05 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3007 is a critical vulnerability (CVSS 9.8) in Getlaminas Laminas-http, published January 4, 2021. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.3%, the 99th percentile. Fixed in laminas/laminas-http 2.14.2.
References
github.com/Ling-Yizhou/zendframework3-/blob/main/zend%20framework3%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%20rce.md
research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet
nvd.nist.gov/vuln/detail/CVE-2021-3007
Left out here: 61 versions. The JSON record has them.