Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Zend Framework components can be slowed down by crafted XML

CVE-2012-6532 · published 13 years ago
Summary

Older versions of Zend Framework (before 1.11.13 and 1.12.0) let attackers send specially formed XML that forces the server to repeat work endlessly, using up CPU. This can make the web application unresponsive. Upgrade the Zend Framework to the latest version or apply the provided patches to stop the problem.

What to do
  • Update zendframework zendframework1 to version 1.11.13.
  • Update zendframework zendframework1 to version 1.12.0.
Affected software
Ecosystem VendorProductAffected versions
composer zendframework zendframework1 >= 1.0, < 1.11.13
>= 1.12.0-rc1, < 1.12.0
Fix: upgrade to 1.11.13
– zend zend_framework 1.0.4
1.5.0
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.7.2
1.7.3
44 more version ranges
cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:*
Original advisory text
(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) v...
(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.
References
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-399Resource Management Errors
Timeline
Published13 Feb 2013
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-jh4x-4wmf-67pr · GHSA
CVE-2012-6532 · NVD
Track software like this
Free during beta