zumba/json-serializer
Serialize PHP variables, including objects, in JSON format. Support to unserialize it too.
View on Github
Activity
- Latest release
- 6mo ago
- Total releases
- 16
- Cadence
- ~7 months
- Last 12 months
- 2
Reach
- Stars
- —
Details
- License
- MIT
- First release
- Jan 06, 2014
| Version | Released | |
|---|---|---|
3.2.4
patch
| ||
3.2.3
patch
| ||
3.2.2
patch
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
3.2.1
patch
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
3.2.0
minor
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
3.1.0
minor
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
3.0.2
patch
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
3.0.1
patch
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
3.0.0
major
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
2.2.0
minor
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
2.1.0
minor
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
2.0.1
patch
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
2.0.0
major
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
1.0.2
patch
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
1.0.1
patch
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev | ||
1.0.0
initial
1 CVE
CVE-2026-27206
GHSA-v7m3-fpcr-h7m2
Feb 19, 2026
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
DescriptionThe Prior to version 3.2.3, the deserializer would instantiate any class specified in the If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as This behavior is similar in risk profile to PHP's native ImpactThis vulnerability allows instantiation of arbitrary PHP classes via the Applications are impacted only if:
Successful exploitation may lead to:
Applications that only deserialize trusted data are not affected. PatchesThis issue is mitigated in version 3.2.3. Version 3.2.3 introduces the method: This allows applications to restrict which classes may be instantiated during deserialization, similar to PHP's native Users should upgrade to version 3.2.3 or later and configure an appropriate class allowlist. WorkaroundsIf upgrading is not immediately possible, applications should ensure that:
After upgrading, users can mitigate risk by explicitly configuring: to disable all object instantiation, or by providing a strict allowlist of safe classes. References
Affected versions
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.1.0
2.2.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
+ 2 more Show less
3.2.1
3.2.2
Fixed in
3.2.3
References
Updated Feb 23, 2026 · Source: OSV.dev |