CVE-2023-41330

Packagist/knplabs/knp-snappy CVE-2023-41330: critical 9.8

Snappy PHAR deserialization vulnerability

Action: Upgrade knplabs/knp-snappy to 1.4.3 or later.

composer require knplabs/knp-snappy:1.4.3

Affected

Fixed versions

Sources

• osv: GHSA-92rv-4j2h-8mjj
• https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj
• https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc
• https://nvd.nist.gov/vuln/detail/CVE-2023-41330
• https://github.com/KnpLabs/snappy/commit/d3b742d61a68bf93866032c2c0a7f1486128b67e
• https://github.com/FriendsOfPHP/security-advisories/blob/master/knplabs/knp-snappy/CVE-2023-41330.yaml
• https://github.com/KnpLabs/snappy
• https://github.com/advisories/GHSA-92rv-4j2h-8mjj

CVE-2023-41330 · published 2023-09-08T12:17:48Z · modified 2026-09-10T03:49:58.157722997Z · JSON