CVE-2021-3007

CVE-2021-3007 is a critical deserialization vulnerability affecting Laminas Project laminas-http (before 2.14.2) and Zend Framework 3.0.0, stemming from the __destruct method of the Zend\Http\Response\Stream class. This flaw allows for remote code execution if an attacker can control the content being deserialized. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, exploit intelligence shows available Nuclei templates and significant community discussion and media coverage, including reports of its exploitation by the FreakOut malware.