Read the docs
TI-2024-08478 Aliases CVE-2024-9129GHSA-56v6-7jgh-2f7r

Format String Injection in Zend Server

Priority MEDIUM 48CWE-134Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-134 and the CVSS impact.

Summary

In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Fix Fixed Zend Server (Zend): 9.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZendZend Server8.5 to before 9.19.1Patch availableCNA
  • Zend Server VendorZend Affected 8.5 to before 9.1 Fixed in 9.1 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_server:*:*:*:*:*:*:*:*——Zend
  • cpe:2.3:a:zend:zend_server:*:*:*:*:*:*:*:* Versions — — ·Zend

Remediation

  • Fix · CNA Zend Server (Zend) Fixed in 9.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-9129
  2. 2026-10-03 Alias added: GHSA-56v6-7jgh-2f7r

References

Other 1

  • TI-2021-22301 OS command injection in ZendTo CVSS 3.1CRITICAL 10.0
  • TI-2021-02150 Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a… CVSS 3.1CRITICAL 9.8
  • TI-2012-02894 Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not… CVSS 3.1CRITICAL 9.1
  • TI-2016-08119 The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11… CVSS 3.0CRITICAL 9.8
  • TI-2025-23435 Type confusion in ZendTo CVSS 3.1MEDIUM 4.8
  • TI-2020-17638 An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute… CVSS 3.1CRITICAL 9.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences