Read the docs
TI-2012-05250 Aliases CVE-2012-6532GHSA-jh4x-4wmf-67pr

(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x…

Priority LOW 27CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-399 and the CVSS impact.

Summary

(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.

Why it matters now

EPSS 0.01848 79th percentileScored 2026-11-07
Fix Fixed zendframework/zendframework1 (Packagist): 1.11.13, 1.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—zendframework/zendframework1 (Packagist)1.0 to before 1.11.131.11.13Patch availableGHSA-jh4x-4wmf-67pr
—zendframework/zendframework1 (Packagist)1.12.0-rc1 to before 1.12.01.12.0Patch availableGHSA-jh4x-4wmf-67pr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.0 to before 1.11.13 Fixed in 1.11.13 Patch available GHSA-jh4x-4wmf-67pr
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.12.0-rc1 to before 1.12.0 Fixed in 1.12.0 Patch available GHSA-jh4x-4wmf-67pr

CPE configurations NVD · 59

CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableZend
  • cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Zend
Show 49 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:*1.7.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:*1.7.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:*1.7.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:*1.8.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:*1.8.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:*1.9.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:*1.9.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:*1.9.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:*1.9.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:*1.9.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:*1.9.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:*1.9.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:*1.10.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:*1.10.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:*1.10.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:*1.10.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:*1.10.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:*1.10.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:*1.10.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:*1.10.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:*1.11.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:*1.11.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:*1.11.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:*1.11.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:*1.11.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:*1.11.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:*1.11.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:*1.11.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:*1.11.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:*1.11.10VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:*1.11.11VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:*1.11.12VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*1.12.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*1.12.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*1.12.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*1.12.0 rc4VulnerableZend
  • cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:* Versions 1.7.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:* Versions 1.7.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:* Versions 1.7.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:* Versions 1.9.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:* Versions 1.9.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:* Versions 1.9.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:* Versions 1.9.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:* Versions 1.10.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:* Versions 1.10.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:* Versions 1.10.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:* Versions 1.10.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:* Versions 1.10.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:* Versions 1.10.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:* Versions 1.10.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:* Versions 1.10.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:* Versions 1.11.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:* Versions 1.11.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:* Versions 1.11.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:* Versions 1.11.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:* Versions 1.11.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:* Versions 1.11.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:* Versions 1.11.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:* Versions 1.11.10 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:* Versions 1.11.11 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:* Versions 1.11.12 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:* Versions 1.12.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:* Versions 1.12.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:* Versions 1.12.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:* Versions 1.12.0 rc4 Vulnerable ·Zend

Remediation

  • Fix · GHSA-jh4x-4wmf-67pr zendframework/zendframework1 (Packagist) Fixed in 1.11.13 Advisory →
  • Fix · GHSA-jh4x-4wmf-67pr zendframework/zendframework1 (Packagist) Fixed in 1.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-6532
  2. 2026-10-03 Alias added: GHSA-jh4x-4wmf-67pr

References

Advisory 3

Other 3

  • TI-2021-02150 Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a… CVSS 3.1CRITICAL 9.8
  • TI-2012-02894 Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not… CVSS 3.1CRITICAL 9.1
  • TI-2016-08119 The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11… CVSS 3.0CRITICAL 9.8
  • TI-2020-17638 An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2016-04204 The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before… CVSS 3.0CRITICAL 9.8
  • TI-2011-01711 SQL injection in zendframework;PHP zendframework CVSS 3.1CRITICAL 9.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences