CVE-2019-9081
Laravel Framework Deserialization Vulnerability
Summary
Remediation
Upgrade to the fixed version using your package manager.
composer require "laravel/framework:^6.20.44"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (1)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| laravel/framework | packagist | v5.7.0, v5.7.1, v5.7.10, v5.7.11 (+186 more) | 6.20.44 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-9081ADVISORY
- https://github.com/Laworigin/Laworigin.github.io/blob/master/2019/02/21/laravelv5-7%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96rce/index.htmlWEB
- https://github.com/laravel/frameworkPACKAGE
- https://github.com/laravel/framework/discussions/40184WEB
- https://laworigin.github.io/2019/02/21/laravelv5-7%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96rceWEB
Frequently Asked Questions
- What is CVE-2019-9081?
- Laravel Framework Deserialization Vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2019-9081?
- CVE-2019-9081 affects laravel/framework. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-9081 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2026-55209CRITICAL
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
- CVE-2026-77414CRITICAL
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
- CVE-2026-77415CRITICAL
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
- CVE-2026-77413CRITICAL
JSONata: Arbitrary Code Execution via crafted JSONata expressions
- CVE-2026-76904CRITICAL
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
- CVE-2026-54061CRITICAL
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
- CVE-2026-55445CRITICAL
Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication
- CVE-2026-61539CRITICAL
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies