Every CVESearch/Get API key

GHSA-96c6-m98x-hxjx

Zend-Session session validation vulnerability

6.5 MediumFix available

GHSA-96c6-m98x-hxjx is a medium vulnerability (CVSS 6.5) in zendframework/zend-session, published June 7, 2024. No source lists public exploit code. Fixed in zendframework/zend-session 2.2.9.

What does this mean?
Severity
6.5 MediumCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.2.9zendframework/zend-session +4 more

Description

Zend\Session session validators do not work as expected if set prior to the start of a session.

For instance, the following test case fails (where $this->manager is an instance of Zend\Session\SessionManager):

$this
    ->manager
    ->getValidatorChain()
    ->attach('session.validate', array(new RemoteAddr(), 'isValid'));

$this->manager->start();

$this->assertSame(
    array(
        'Zend\Session\Validator\RemoteAddr' =3D> '',
    ),
    $_SESSION['__ZF']['_VALID']
);

The implication is that subsequent calls to Zend\Session\SessionManager#start() (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.

An attacker is thus able to simply ignore session validators such as RemoteAddr or HttpUserAgent, since the "signature" that these validators check against is not being stored in the session.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
zendframework/zend-session
Packagist
2.0.0 up to 2.2.9
2.2.9
zendframework/zend-session
Packagist
2.3.0 up to 2.3.4
2.3.4
zendframework/zend-session
TuxCare:Packagist
2.1.6 up to 2.1.6-p2+tuxcare
2.1.6-p2+tuxcare
zendframework/zend-session
Packagist
2.0.0 up to 2.2.9, plus listed versions
2.0.32.0.42.0.52.0.62.0.7
Show 20 moreShow less
2.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.8
2.2.9
zendframework/zend-session
Packagist
2.3.0 up to 2.3.4, plus listed versions
2.3.12.3.22.3.3
2.3.4

What each source reports

GitHub Advisories Score used6.5

Zend-Session session validation vulnerability

Zend\Session session validators do not work as expected if set prior to the start of a session.

For instance, the following test case fails (where $this->manager is an instance of Zend\Session\SessionManager):

$this
    ->manager
    ->getValidatorChain()
    ->attach('session.validate', array(new RemoteAddr(), 'isValid'));

$this->manager->start();

$this->assertSame(
    array(
        'Zend\Session\Validator\RemoteAddr' =3D> '',
    ),
    $_SESSION['__ZF']['_VALID']
);

The implication is that subsequent calls to Zend\Session\SessionManager#start() (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.

An attacker is thus able to simply ignore session validators such as RemoteAddr or HttpUserAgent, since the "signature" that these validators check against is not being stored in the session.

Record
GHSA-96c6-m98x-hxjx
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-384
Updated
2026-11-02
OSV6.5

Zend-Session session validation vulnerability

Zend\Session session validators do not work as expected if set prior to the start of a session.

For instance, the following test case fails (where $this->manager is an instance of Zend\Session\SessionManager):

$this
    ->manager
    ->getValidatorChain()
    ->attach('session.validate', array(new RemoteAddr(), 'isValid'));

$this->manager->start();

$this->assertSame(
    array(
        'Zend\Session\Validator\RemoteAddr' =3D> '',
    ),
    $_SESSION['__ZF']['_VALID']
);

The implication is that subsequent calls to Zend\Session\SessionManager#start() (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.

An attacker is thus able to simply ignore session validators such as RemoteAddr or HttpUserAgent, since the "signature" that these validators check against is not being stored in the session.

Record
GHSA-96c6-m98x-hxjx
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-384
Updated
2026-11-02
OSVCLSA-2026-1789376005No score

TuxCare security update for zendframework/zend-session (1 CVE)

TuxCare rebuilt zendframework/zend-session to address 1 CVE. Fixed in 2.1.6-p1+tuxcare.

Record
CLSA-2026-1789376005
Updated
2026-11-02
OSVCLSA-2026-1790350388No score

TuxCare security update for zendframework/zend-session (1 CVE)

TuxCare rebuilt zendframework/zend-session to address 1 CVE. Fixed in 2.1.6-p2+tuxcare.

Record
CLSA-2026-1790350388
Updated
2026-11-02

History

History
RecordedChangedSources
affected
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 10 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open