GHSA-f4fj-q6m4-cc52

ZendFramework vulnerable to XXE/XEE attacks

9.8 CriticalFix available

GHSA-f4fj-q6m4-cc52 is a critical vulnerability (CVSS 9.8) in zendframework/zend-xmlrpc, published June 7, 2024. No source lists public exploit code. Fixed in zendframework/zend-xmlrpc 2.1.6.

What does this mean?

Severity: 9.8 CriticalCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.1.6zendframework/zend-xmlrpc +3 more

Description

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:

XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Affected packages

Affected packages
Package	Affected	Fixed
`zendframework/zend-xmlrpc` Packagist	2.1.0 up to 2.1.6	2.1.6
`zendframework/zend-xmlrpc` Packagist	2.2.0 up to 2.2.6	2.2.6
`zendframework/zend-xmlrpc` Packagist	2.1.0 up to 2.1.6, plus listed versions 2.1.12.1.22.1.32.1.42.1.5	2.1.6
`zendframework/zend-xmlrpc` Packagist	2.2.0 up to 2.2.6, plus listed versions 2.2.12.2.22.2.32.2.42.2.5	2.2.6

What each source reports

GitHub Advisories Score used9.8

ZendFramework vulnerable to XXE/XEE attacks

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:

XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

Record: GHSA-f4fj-q6m4-cc52
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611, CWE-776
Updated: 2026-11-02

OSV9.8

ZendFramework vulnerable to XXE/XEE attacks

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:

XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

Record: GHSA-f4fj-q6m4-cc52
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611, CWE-776
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 4 moreShow less