Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Zend Framework 1 versions 1.12.0 through 1.12.17 (Packagist package zendframework/zendframework1) use rand() or mt_rand(), which are not cryptographically secure, in several random number generators, and the advisory also raises a possible issue with openssl_random_pseudo_bytes() in Zend_Crypt_Math::randBytes. An attacker who can brute force the generated values could potentially obtain information disclosure. Upgrade to version 1.12.18. The source gives few details on the exact affected methods and the attack conditions.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:28 UTC First seen by agentprime
- 31 Oct 2026, 14:28 UTC Confirmed by OSV