{"id":"CVE-2021-29476","aliases":["DEBIAN-CVE-2021-29476","EUVD-2021-0762","GHSA-52qp-jpq7-6c54","UBUNTU-CVE-2021-29476"],"status":"published","title":"Insecure Deserialization of untrusted data in rmccue/requests","description":"Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02142,"percentile":0.82205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2021-04-27T20:55:13Z","modified":"2026-10-23T18:04:49Z","fixes":[{"ecosystem":"Packagist","package":"rmccue/requests","fixed_in":["1.8.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["5.5.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["5.5.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["5.5.3+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"rmccue/requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"rmccue/requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.8.0"}]}],"versions":["v1.6.0","v1.6.1","v1.7.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]}],"products":[{"vendor":"psf","product":"requests"},{"vendor":"wordpress","product":"requests"}],"references":[{"url":"https://github.com/WordPress/Requests/security/advisories/GHSA-52qp-jpq7-6c54","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/rmccue/Requests/pull/421","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29476","tags":["advisory"]},{"url":"https://github.com/ambionics/phpggc/issues/52","tags":["web"]},{"url":"https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3","tags":["web","report"]},{"url":"https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf","tags":["web"]},{"url":"https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/"},{"url":"https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf","tags":["web"]},{"url":"https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/rmccue/requests/CVE-2021-29476.yaml","tags":["web"]},{"url":"https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf","tags":["web"]},{"url":"https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f","tags":["web"]},{"url":"https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/","tags":["report"]},{"url":"https://github.com/advisories/GHSA-52qp-jpq7-6c54"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-29476","tags":["advisory"]},{"url":"https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security","tags":["web"]},{"url":"https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-29476","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29476","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-29476","title":"Insecure Deserialization of untrusted data in rmccue/requests","description":"Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.","status":"published","published":"2021-04-27T20:55:13Z","modified":"2024-08-03T22:11:05.121Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:33:06.32268Z"}],"euvd":[{"id":"EUVD-2021-0762","description":"Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.","status":"published","published":"2021-04-27T20:55:13Z","modified":"2024-08-03T22:11:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:24:44.540278Z"}],"ghsa":[{"id":"GHSA-52qp-jpq7-6c54","title":"Insecure Deserialization of untrusted data in rmccue/requests","description":"### Impact\nUnserialization of untrusted data.\n\n### Patches\nThe issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.\n\n### References\nPublications about the vulnerability:\n* https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress\n* https://github.com/ambionics/phpggc/issues/52\n* https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/\n* https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf\n* https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf\n* https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf\n* https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f\n\nOriginally fixed in WordPress 5.5.2:\n* https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3\n* https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/\n\nRelated Security Advisories:\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28032\n* https://nvd.nist.gov/vuln/detail/CVE-2020-28032\n\nNotification to the Requests repo including a fix in:\n* https://github.com/rmccue/Requests/pull/421 and\n* https://github.com/rmccue/Requests/pull/422\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Request](https://github.com/WordPress/Requests/)","status":"published","published":"2021-04-29T21:52:30Z","modified":"2023-02-01T05:05:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:34.917834Z"}],"nvd":[{"id":"CVE-2021-29476","description":"Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.","status":"published","published":"2021-04-27T21:15:08.107Z","modified":"2026-06-17T03:47:43.223Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-29476","description":"Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.","status":"published","published":"2021-04-27T21:15:08.107Z","modified":"2026-10-20T10:54:38.430466801Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-29476","description":"Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.","status":"published","published":"2021-04-27T21:15:08.107Z","modified":"2026-10-23T18:04:49.794404998Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-52qp-jpq7-6c54","title":"Insecure Deserialization of untrusted data in rmccue/requests","description":"### Impact\nUnserialization of untrusted data.\n\n### Patches\nThe issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.\n\n### References\nPublications about the vulnerability:\n* https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress\n* https://github.com/ambionics/phpggc/issues/52\n* https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/\n* https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf\n* https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf\n* https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf\n* https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f\n\nOriginally fixed in WordPress 5.5.2:\n* https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3\n* https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/\n\nRelated Security Advisories:\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28032\n* https://nvd.nist.gov/vuln/detail/CVE-2020-28032\n\nNotification to the Requests repo including a fix in:\n* https://github.com/rmccue/Requests/pull/421 and\n* https://github.com/rmccue/Requests/pull/422\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Request](https://github.com/WordPress/Requests/)","status":"published","published":"2021-04-29T21:52:30Z","modified":"2026-07-08T06:27:55.875940375Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"UBUNTU-CVE-2021-29476","description":"Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.","status":"published","published":"2021-04-27T21:15:00Z","modified":"2025-10-24T04:50:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"}]}}