Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zendframework/zend-xmlrpc

              master @ bfd5e93
            

Fixes

CVEs

MEDIUM

Peak severity

0.0%

Coverage

Highlights

XML External Entity (XXE): 3 prior fixes. Scrutinize any change in this area.

src/Response.php: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Response parsing was fixed twice for XXE, indicating a recurring weakness in this component; both direct SimpleXMLElement construction and potentially other parsing paths need hardening.

XML External Entity (XXE): Fault handling parses XML from untrusted responses; the fix replaced direct parsing with XmlSecurity::scan, but sibling paths (e.g., fault sub-parsing) may still be vulnerable.

XML External Entity (XXE): Request parsing is a primary entry point for attacker-controlled XML; the fix disabled external entities, but any alternate request loaders (e.g., automatic or sub-request paths) may miss this guard.