CVE-2021-3007: Laminas-http and Zend Framework PHP deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and public exploit references plus very high EPSS make this a top remediation target despite the missing KEV listing.

What it is

Laminas-http before 2.14.2 and Zend Framework 3.0.0 contain a PHP object deserialization flaw tied to the __destruct method of Zend\Http\Response\Stream in Stream.php. When attacker-controlled content is deserialized, it can lead to remote code execution. The vendor frames this as a PHP language issue and only added type checking to block exploitation in unrecommended use cases, and Zend Framework is no longer maintained.

Impact

An attacker who can get untrusted data deserialized gains remote code execution in the PHP process, giving full control over confidentiality, integrity and availability of the affected application and host.

Attack surface

Reached over the network with no authentication and no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), but exploitation requires the application to deserialize attacker-supplied content, which the vendor describes as an unrecommended use case.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.753, 99.5th percentile) and public references are tagged Exploit, including a Check Point research writeup on botnet use.

What to do

• Upgrade laminas-http to 2.14.2 or later, which adds type checking in Stream.php.
• If Zend Framework 3.0.0 is still in use, migrate off it since the maintainer no longer supports it.
• Eliminate deserialization of attacker-supplied data; never pass untrusted input to unserialize().
• Where deserialization is unavoidable, restrict allowed classes and validate input types before use.
• Monitor and restrict outbound network traffic from PHP application hosts to limit post-exploitation activity.

Detection

• Search application code and logs for unserialize() calls handling request, cookie or file input.
• Alert on PHP processes spawning unexpected child processes or making unusual outbound connections.
• Look for requests containing serialized PHP object payloads (O: or a: patterns) in parameters, cookies or bodies.
• Monitor for Zend\Http\Response\Stream class references in serialized input reaching the application.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.