CVE-2015-7503

Zend Framework Information Disclosure

7.5 HighFix available

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.36%Up 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

Record: CVE-2015-7503
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-320
Updated: 2026-11-02

CVE List No score

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

Record: CVE-2015-7503
Updated: 2026-11-02

EUVDEUVD-2022-4795 No score

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

Record: EUVD-2022-4795
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pm9m-w23q-5967 7.5

Zend Framework Information Disclosure

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

Record: GHSA-pm9m-w23q-5967
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-pm9m-w23q-5967 7.5

Zend Framework Information Disclosure

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

Record: GHSA-pm9m-w23q-5967
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVMGASA-2016-0196 No score

Updated php-ZendFramework2 packages fix CVE-2015-7503

Updated php-ZendFramework2 packages fix security vulnerability:

Zend\Crypt\PublicKey\Rsa\PublicKey has a call to openssl_public_encrypt() which uses PHP's default $padding argument, which specifies OPENSSL_PKCS1_PADDING, indicating usage of PKCS1v1.5 padding. This padding has a known vulnerability, the Bleichenbacher's chosen-ciphertext attack, which can be used to decrypt arbitrary ciphertexts (CVE-2015-7503).

Record: MGASA-2016-0196
Updated: 2026-11-02

Affected products

zend framework

Affected packages

Affected packages
Package	Affected	Fixed
`zendframework/zendframework` Packagist	2.5.0 up to 2.5.2	2.5.2
`zendframework/zend-crypt` Packagist	2.0.0 up to 2.4.9	2.4.9
`zendframework/zend-crypt` Packagist	2.5.0 up to 2.5.2	2.5.2
`zendframework/zendframework` Packagist	2.0.0 up to 2.4.9	2.4.9
`zendframework/zendframework` Packagist	2.5.0 up to 2.5.2, plus listed versions 2.5.1	2.5.2
`zendframework/zend-crypt` Packagist	2.0.0 up to 2.4.9, plus listed versions 2.0.32.0.42.0.52.0.62.0.7 Show 45 moreShow less 2.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0rc12.4.0rc22.4.0rc32.4.0rc42.4.0rc52.4.0rc62.4.0rc72.4.12.4.22.4.32.4.42.4.5	2.4.9
`zendframework/zend-crypt` Packagist	2.5.0 up to 2.5.2, plus listed versions 2.5.1	2.5.2
`zendframework/zendframework` Packagist	2.0.0 up to 2.4.9, plus listed versions 2.0.12.0.22.0.32.0.42.0.5 Show 45 moreShow less 2.0.62.0.72.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0rc12.4.0rc22.4.0rc32.4.0rc42.4.0rc52.4.0rc62.4.0rc72.4.12.4.22.4.3	2.4.9
`php-ZendFramework2` Mageia:5	before 2.4.9-1.mga5	2.4.9-1.mga5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-7503 is a high vulnerability (CVSS 7.5) in Zend Framework, published May 21, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in zendframework/zendframework 2.5.2.

References

This page doesn't list everything

Left out here: 8 versions. The JSON record has them.