CVE-2026-23524 json
Laravel Redis Horizontal Scaling Insecure Deserialization
published 2026-01-21 9 mo ago modified 2026-06-17 4 mo ago also GHSA-m27r-m6rx-mhm4 , EUVD-2026-3681
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node).
Patch / fix
- packagist laravel/reverb 1.7.0
- laravel reverb 1.7.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction
0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | laravel/reverb | <1.7.0 |
1.7.0 |
Affected products
- laravel reverb
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1a
web, patch
-
github.com
/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4
web, mitigation, vendor-advisory
-
cwe.mitre.org
/data/definitions/502.html
technical-description
-
github.com
/laravel/reverb/releases/tag/v1.7.0
web, product, release-notes
-
laravel.com
/docs/12.x/reverb#scaling
web, technical-description
-
nvd.nist.gov
/vuln/detail/CVE-2026-23524
advisory
-
github.com
/laravel/reverb
package
-
laravel.com
/docs/reverb#scaling
web
Sources
- CVE List CVE-2026-23524
- GitHub Advisory GHSA-m27r-m6rx-mhm4
- NVD CVE-2026-23524
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.