/
← Voltar ao feed
medium

CERT-FR: Multiple vulnerabilities in Laravel 12.x and 13.x allow DoS, integrity impact and security policy bypass

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 21:00 · coletado há 12 horas

CERT-FR advisory CERTFR-2026-AVI-1343 reports multiple vulnerabilities in the Laravel PHP framework. According to the advisory, a remote attacker could exploit them to cause a denial of service, compromise data integrity or bypass the security policy. The fixes are described in two Laravel GitHub security advisories published on 19 October 2026. The advisory does not mention active exploitation, CVE identifiers, IOCs or attribution.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1343 reports multiple vulnerabilities in the Laravel PHP framework. A remote attacker could cause a denial of service, violate data integrity or bypass the security policy. No CVE IDs are assigned. The advisory does not say which impact belongs to which flaw, and gives no attack prerequisites (authentication, configuration, user interaction) or CVSS scores. Affected versions are listed as Laravel 12.68.x before 12.68.0 and 13.29.x before 13.29.0, so the fixes are in 12.68.0 and 13.29.0. Laravel's own advisories carry the details.

Onde está

The articles name no file, function or commit; the fixes are described in the Laravel GitHub security advisories GHSA-5wcm-3v2w-8362 and GHSA-f9x3-7vq9-cph6 in the laravel/framework repository.

Como foi descoberta

The articles do not say who found the flaws or how. Laravel published two GitHub security advisories on 19 October 2026, GHSA-5wcm-3v2w-8362 and GHSA-f9x3-7vq9-cph6, and CERT-FR summarised them in its advisory dated 20 October 2026. The advisory does not mention active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:20.

Detalhes técnicos

  • Affected: Laravel 12.68.x before 12.68.0 and 13.29.x before 13.29.0, as listed in the advisory.
  • Vendor advisories referenced: GHSA-5wcm-3v2w-8362 and GHSA-f9x3-7vq9-cph6, both dated 19 October 2026.
  • Impacts listed: remote denial of service, data integrity violation and security policy bypass.
  • The advisory does not map each impact to a specific advisory, nor does it give attack vectors or CVSS scores.

Remediação

  • Consult the Laravel security advisories on GitHub (laravel/framework) to obtain the patches.
  • Upgrade Laravel to the fixed releases for the branch in use, as indicated in the vendor advisories.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 19/10/2026 21:00 · coletado 22/10 13:01 primeiro registro

    CERT-FR: Multiple vulnerabilities in Laravel 12.x and 13.x allow DoS, integrity impact and security policy bypass

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1343 reports multiple vulnerabilities in the Laravel PHP framework. According to the advisory, a remote attacker could exploit them to cause a denial of service, compromise data integrity or bypass the security policy. The fixes are described in two Laravel GitHub security advisories published on 19 October 2026. The advisory does not mention active exploitation, CVE identifiers, IOCs or attribution.

    Technical Details

    • Affected: Laravel 12.68.x before 12.68.0 and 13.29.x before 13.29.0, as listed in the advisory.
    • Vendor advisories referenced: GHSA-5wcm-3v2w-8362 and GHSA-f9x3-7vq9-cph6, both dated 19 October 2026.
    • Impacts listed: remote denial of service, data integrity violation and security policy bypass.
    • The advisory does not map each impact to a specific advisory, nor does it give attack vectors or CVSS scores.

    Remediation

    • Consult the Laravel security advisories on GitHub (laravel/framework) to obtain the patches.
    • Upgrade Laravel to the fixed releases for the branch in use, as indicated in the vendor advisories.