CVE-2021-29476

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
WordPress	Requests	>= 1.6.0, < 1.8.0

References

https://github.com/WordPress/Requests/security/advisories/GHSA-52qp-jpq7-6c54Third Party Advisory
https://github.com/rmccue/Requests/pull/421Patch, Third Party Advisory
https://github.com/WordPress/Requests/security/advisories/GHSA-52qp-jpq7-6c54Third Party Advisory
https://github.com/rmccue/Requests/pull/421Patch, Third Party Advisory

Timeline

Published: Apr 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294778.8Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow b CVE-2021-294788.8Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow b CVE-2021-294796.1Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to per CVE-2021-294803.1Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup CVE-2021-294817.5Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in CVE-2021-294827.5xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the CVE-2021-294837.5ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through th CVE-2021-294846.8Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access CVE-2021-294858.8Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE)CVE-2021-294867.5cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data CVE-2021-294877.4octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit CVE-2021-294885.3SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function