Symfony components security advisories

Supported components branches

All Symfony components advisories

128 advisories, newest first.

• low Symfony · Nov 4, 2026 · Reviewed Nov 7

  Symfony HtmlSanitizer: Hostless URLs Slip Past Link and Media Host Lists

  Lets links or media point to hosts outside allowLinkHosts() or allowMediaHosts() when allowRelativeLinks or allowRelativeMedias is on.

  Fixed in 8.1.11, 7.4.23 and 6.4.50

• high Symfony · Nov 4, 2026 · Reviewed Nov 6

  Symfony Security: HEAD Requests Skip access_control Rules Limited to GET

  Lets HEAD requests reach pages that access_control rules or firewalls protect only for GET, running the controller without the check.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• high Symfony · Nov 4, 2026 · Reviewed Nov 6

  Symfony X509 Login: Crafted Certificate Names Can Log In as Another User

  Lets a client certificate holder log in as another user's email address in apps that use Symfony's X509 authenticator.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• high Symfony · Nov 4, 2026 · Reviewed Nov 6

  Symfony Serializer: Fake UploadedFile Data Can Point at Any Server File

  Lets a client make an app treat any server file as an upload in apps that deserialize request data into UploadedFile properties.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• high Symfony · Nov 4, 2026 · Reviewed Nov 6

  Symfony Routing: Host Placeholders Can Bypass Path-Based Access Rules

  Lets requests reach controllers that path-based access_control rules protect, in apps with routes that use host placeholders.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• medium Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony Validator: Ip Constraint Accepts Some Internal Addresses as Public

  Lets internal addresses pass #[Assert\Ip] public or no-private checks, getting past SSRF guards built on the Ip constraint.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• low Symfony · Nov 4, 2026 · Reviewed Nov 7

  Symfony HttpFoundation: Paths Glued to index.php Bypass Web Server Path Rules

  Lets requests get past nginx, Apache, CDN or WAF rules on a path like /admin, while Symfony still routes them to that path.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• medium Symfony · Nov 4, 2026 · Reviewed Nov 6

  Symfony: private_ranges Trusted Proxies Setting Trusts Some Remote Clients

  Lets some IPv6 clients pass as trusted proxies and set X-Forwarded headers in apps that use trusted_proxies: private_ranges.

  Fixed in 8.1.11 and 7.4.23

• medium Symfony · Nov 4, 2026 · Reviewed Nov 6

  Symfony HttpFoundation: Crafted Links Make Generated URLs Point Elsewhere

  Lets a crafted link make an app's links, forms and redirects point to another host, when its front controller sits in a subdirectory.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• high Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony Yaml: Small Documents Can Tie Up the Parser for Minutes

  Lets an attacker keep a PHP worker busy with one small YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• high Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony Serializer: Data URIs Can Read Any File on the Server

  Lets a client read any file PHP can read in apps that deserialize client data into SplFileObject, SplFileInfo or File properties.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• medium Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony Serializer: Nested Properties Marked #[Ignore] Can Still Be Set

  Lets a client set #[Ignore] properties on nested objects in apps that deserialize input with ObjectNormalizer, such as #[MapRequestPayload].

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56 · 1 older release

• low Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony Security: Programmatic Logins Skip checkPostAuth() User Checks

  Lets accounts a user checker rejects in checkPostAuth(), such as expired ones, log in through Security::login() or authenticateUser().

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• low Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony HtmlSanitizer: srcset Images Skip Media Scheme and Host Checks

  Lets sanitized HTML load images from hosts outside allowMediaHosts() through srcset or imagesrcset attributes.

  Fixed in 8.1.11, 7.4.23 and 6.4.50

• high Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony HttpClient: Scoped Client Can Send Credentials to Other Hosts

  Can send a scoped client's token or other credentials to another host when an attacker controls the start of a URL the app requests.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• low Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony Config: XmlUtils::parse() Resolves External Entities in Untrusted XML

  Can reveal whether server files exist, or leak them through network stream wrappers, in apps that pass untrusted XML to XmlUtils::parse().

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• medium Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony HtmlSanitizer: Meta Refresh URLs Slip Past Link Checks

  Lets meta refresh tags send visitors to blocked hosts or javascript: URLs in apps that allow meta refresh through HtmlSanitizer.

  Fixed in 8.1.11, 7.4.23 and 6.4.50

• low Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony HttpKernel: Inline Fragments Let Forwarded Headers Change URLs

  Lets client headers set the host of absolute URLs after an inline fragment renders, in apps reached from 127.0.0.1 without it as a trusted proxy.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56 · 2 older releases

• high Symfony · Nov 4, 2026 · Reviewed Nov 5

  Symfony Filesystem: Crafted Paths Can Escape Their Base Directory

  Lets an attacker read or write files outside an allowed folder in apps that check user paths with Path, and lets packages write outside assets/vendor.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• low Symfony · Nov 4, 2026 · Reviewed Nov 10

  Symfony HttpClient: DNS Rebinding Lets NoPrivateNetworkHttpClient Probe Ports

  Lets an attacker who controls a host's DNS probe internal hosts and ports through repeated NoPrivateNetworkHttpClient requests to that host.

  Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

• medium Symfony · Nov 4, 2026 · Reviewed Nov 6

  Symfony JsonPath: Crafted Queries Can Still Tie Up a Worker

  Lets an attacker keep a PHP worker busy for minutes in apps that run JSONPath queries an attacker can influence, despite the CVE-2026-45756 fix.

  Fixed in 8.1.11 and 7.4.23

• medium Symfony · Oct 28, 2026 · Reviewed Oct 31

  Symfony Mime: Header Injection Through Mime Parameter Names

  Lets an attacker add extra email headers in apps that build a Content-Type or Content-Disposition parameter name from user input.

  Fixed in 8.1.10, 7.4.22, 6.4.49 and 5.4.55

• medium Symfony · Oct 14, 2026 · Reviewed Oct 31

  Symfony ExpressionLanguage: Deeply Nested Expressions Crash PHP

  Lets an attacker crash the PHP process with one request in apps that parse or validate expressions written by users.

  Fixed in 8.1.9, 7.4.21, 6.4.48 and 5.4.54

• high Symfony · Sep 15, 2026 · Reviewed Nov 1

  Symfony HttpFoundation: Crafted Cache-Control Header Ties Up the CPU

  Lets an unauthenticated attacker burn close to a second of CPU per request with a crafted Cache-Control header, in any app built on HttpFoundation.

  Fixed in 8.1.7, 7.4.19, 6.4.46 and 5.4.54

• high Symfony · Aug 30, 2026 · Reviewed Nov 1

  Symfony Yaml: Deeply Nested Inline YAML Crashes the Process

  Lets an attacker crash the PHP process with one YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.

  Fixed in 8.1.6, 7.4.18, 6.4.45 and 5.4.54

• medium Symfony · Jun 9, 2026 · Reviewed Nov 2

  Symfony Runtime: Web Requests Can Still Switch APP_ENV and APP_DEBUG

  Lets an unauthenticated request change the app environment or debug mode on servers with register_argc_argv=On, bypassing the CVE-2024-50340 fix.

  Fixed in 6.4.40 and 5.4.52 · 2 older releases

• medium Symfony · May 26, 2026 · Reviewed Nov 3

  Symfony HttpClient: IPv6 Transition Addresses Bypass Private Network Block

  Lets an attacker reach private network hosts through NoPrivateNetworkHttpClient by using IPv6 addresses that wrap a private IPv4 address.

  Fixed in 7.4.13, 6.4.41 and 5.4.53 · 1 older release

• medium Symfony · May 26, 2026 · Reviewed Nov 3

  Symfony HtmlSanitizer: Some URL Attributes Skip URL Checks

  Lets javascript: and other blocked URLs through in attributes like object data, in apps that allow those attributes in HtmlSanitizer.

  Fixed in 7.4.13 and 6.4.41 · 1 older release

• medium Symfony · May 26, 2026 · Reviewed Nov 3

  Symfony Routing: Chained ../ in Parameters Escape Generated URLs

  Can make URLs built by UrlGenerator point to a different path than intended when a route parameter holds a chain of ../ or ./ segments.

  Fixed in 7.4.13, 6.4.41 and 5.4.53 · 1 older release

• medium Symfony · May 26, 2026 · Reviewed Nov 3

  Symfony Mailer Mailomat: Webhook Request Picks Its Own HMAC Algorithm

  Lets a Mailomat webhook request choose a weak HMAC algorithm for its signature check, weakening webhook authentication.

  Fixed in 7.4.13 · 1 older release

• medium Symfony · May 26, 2026 · Reviewed Nov 3

  Symfony HtmlSanitizer: Encoded BiDi Marks Slip Past Link Spoofing Checks

  Lets percent-encoded direction marks and Unicode spaces through HtmlSanitizer, so decoded links can be made to look like other domains.

  Fixed in 7.4.13 and 6.4.41 · 1 older release

• high Symfony · May 26, 2026 · Reviewed Nov 3

  Symfony Security: failure_forward Lets Anyone Reach Protected Pages

  Lets an unauthenticated user load access_control-protected GET routes in apps that use form login with failure_forward turned on.

  Fixed in 7.4.13, 6.4.41 and 5.4.53 · 1 older release

• low Symfony · May 26, 2026 · Reviewed Nov 3

  Symfony Polyfill IDN: Invalid xn-- Labels Treated as Normal Domains

  Can let two different domain names compare as equal, getting past domain blocklists, on PHP installs without the intl extension.

  Only affects branches that no longer get security fixes

• low Symfony · May 20, 2026 · Reviewed Nov 4

  Symfony Yaml: Alias Expansion Can Use Up All Memory

  Lets a small YAML document expand into gigabytes of data through aliases, in apps that parse untrusted YAML.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 4

  Symfony Mailer: Recipient Addresses Can Become Sendmail Options

  Lets a recipient address starting with a dash pass options to sendmail, in apps using SendmailTransport in -t mode.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• low Symfony · May 20, 2026 · Reviewed Nov 4

  Symfony Yaml: Crafted Header Line Makes the Parser Hang

  Lets an attacker tie up the parser for a long time with one crafted YAML header or comment line, in apps that parse untrusted YAML.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• low Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony HtmlSanitizer: javascript: URLs Survive in Form and Media Attributes

  Can allow cross-site scripting through action, formaction, poster or cite attributes in apps that allow them in HtmlSanitizer.

  Fixed in 7.4.12 and 6.4.40 · 1 older release

• low Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony DomCrawler: addXmlContent() Can Read Local Files

  Can expose local server files when an app loads untrusted XML with Crawler::addXmlContent(), including pages fetched by HttpBrowser.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony Mailer Mailjet and LOX24: Webhook Secrets Are Never Checked

  Lets anyone send fake email or SMS events to apps that use the Mailjet or LOX24 webhook parsers, even with a secret set.

  Fixed in 7.4.12 and 6.4.40 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 7

  Symfony Twilio Notifier: Webhooks Accepted Without Checking Twilio's Signature

  Lets anyone who finds a Twilio webhook endpoint send fake SMS status events, even when a webhook signing secret is configured.

  Fixed in 7.4.12 and 6.4.40 · 1 older release

• low Symfony · May 20, 2026 · Reviewed Nov 7

  Symfony JsonPath: User-Supplied Regex in match() or search() Can Stall Workers

  Lets an attacker tie up CPU in apps that evaluate JSONPath expressions taken from user input with JsonCrawler.

  Fixed in 7.4.12 · 1 older release

• high Symfony · May 20, 2026 · Reviewed Nov 7

  Symfony server:log Command: Network Listener Unserializes Untrusted Data

  Lets anyone who can reach port 9911 on a machine running server:log crash it or inject PHP objects, and in some setups run code.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 7

  Symfony OidcTokenHandler: Tokens Without aud, iss or exp Claims Are Accepted

  Lets a validly signed OpenID Connect token that leaves out its audience, issuer or expiry claim pass Symfony's OIDC token check.

  Fixed in 7.4.12 and 6.4.40 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 7

  Symfony Cache PdoAdapter: SQL Injection Through the clear() Prefix

  Allows SQL injection, such as deleting other rows, in apps that pass untrusted input as the prefix to PdoAdapter's clear() method.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony HtmlSanitizer: Malformed URLs Slip Past Link and Media Host Lists

  Lets sanitized HTML link or load media from hosts outside allowLinkHosts() or allowMediaHosts() through URLs browsers read differently.

  Fixed in 7.4.12 and 6.4.40 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony HtmlSanitizer: Direction Marks in URLs Let Links Look Like Others

  Lets sanitized links carry Unicode direction marks that make a link's shown address differ from where it really goes.

  Fixed in 7.4.12 and 6.4.40 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony Mailer Mailtrap: Webhook Signatures Are Never Checked

  Lets anyone send fake delivery, bounce or click events to apps that use the Mailtrap webhook parser, even with a secret set.

  Fixed in 7.4.12 · 1 older release

• high Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony X509 Login: Crafted Certificate Names Can Pose as Another User

  Lets a client certificate holder log in as another user by hiding an email in the certificate name, in apps using X509Authenticator.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony Routing: Loose Route Requirements Let Links Point Off-Site

  Lets a crafted parameter value pass a route requirement written as a list of options, so path() or url() builds a link to another host.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Oct 31

  Symfony Runtime: Web Requests Can Still Switch APP_ENV and APP_DEBUG

  Lets an unauthenticated request change the app environment or debug mode on servers with register_argc_argv=On, bypassing the CVE-2024-50340 fix.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• high Symfony · May 20, 2026 · Reviewed Nov 6

  Symfony Mime: Line Breaks in Addresses Allow Email Header Injection

  Lets an attacker add email headers or SMTP commands through a crafted address in apps that pass user addresses to Symfony Mailer.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• medium Symfony · May 20, 2026 · Reviewed Nov 4

  Symfony Security CAS: Tickets From Other Services Can Log In as the User

  Lets an attacker who runs another app on the same CAS server log in as a victim, in apps using Cas2Handler without trusted_hosts.

  Fixed in 7.4.12 · 1 older release

• low Symfony · May 20, 2026 · Reviewed Nov 4

  Symfony Yaml: Deeply Nested YAML Crashes the Process

  Lets an attacker crash the PHP worker with one deeply nested YAML document in apps that parse untrusted YAML.

  Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release

• low Symfony · May 20, 2026 · Reviewed Nov 4

  Symfony Profiler: Stored Cross-Site Scripting in File Excerpts

  Lets someone who can write to a project file, like a log, run script in a developer's browser when they view it in the profiler.

  Fixed in 7.4.12 and 6.4.40 · 1 older release

• high Symfony · May 20, 2026 · Reviewed Nov 4

  Symfony Security: HEAD Requests Skip Checks Limited to GET

  Lets HEAD requests skip #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] checks that set methods: ['GET'].

  Fixed in 7.4.12 · 1 older release

• medium Symfony · Jan 28, 2026 · Reviewed Nov 7

  Symfony Process on Windows: Git Bash Can Mangle Arguments and Hit Wrong Paths

  Can make file commands run through Symfony Process act on the wrong path, up to deleting a whole directory, when PHP runs from Git Bash.

  Fixed in 7.4.5, 6.4.33 and 5.4.51 · 2 older releases

• high Symfony · Nov 12, 2025 · Reviewed Nov 8

  Symfony HttpFoundation: Malformed Paths Can Slip Past Access Rules

  Lets an attacker reach some URLs that path-based access rules should block, in apps whose rules assume every path starts with a slash.

  Fixed in 6.4.29 and 5.4.50 · 1 older release

• high Symfony · Nov 13, 2024 · Reviewed Nov 9

  Symfony Remember-Me: Persistent Tokens Let a User Log In as Someone Else

  Lets someone with a valid remember-me token log in as a different user in Symfony apps that store remember-me tokens with a token provider.

  Fixed in 6.4.15 and 5.4.47 · 1 older release

• low Symfony · Nov 13, 2024 · Reviewed Nov 9

  Symfony HttpClient: NoPrivateNetworkHttpClient Leaks Internal Hosts and Ports

  Can let an attacker map internal IP addresses and ports through apps that fetch user-supplied URLs with NoPrivateNetworkHttpClient.

  Fixed in 6.4.15 and 5.4.47 · 1 older release

• low Symfony · Nov 5, 2024 · Reviewed Nov 9

  Symfony HttpFoundation: Malformed URLs Can Slip Past Redirect Checks

  Lets an attacker send users to another domain when an app checks redirect targets with the Request class, which parsed some URLs unlike browsers.

  Fixed in 6.4.14 and 5.4.46 · 1 older release

• high Symfony · Nov 5, 2024 · Reviewed Nov 9

  Symfony Process on Windows: A cmd.exe in the Working Directory Gets Run

  Lets a cmd.exe file in the current working directory run instead of the real one when Symfony's Process class runs commands on Windows.

  Fixed in 6.4.14 and 5.4.46 · 1 older release

• medium Symfony · Nov 5, 2024 · Reviewed Nov 9

  Symfony Runtime: Query Strings Can Change the Environment and Debug Mode

  Lets anyone switch the environment or debug mode of a Symfony app for a request, on servers where PHP's register_argc_argv is On.

  Fixed in 6.4.14 and 5.4.46 · 1 older release

• low Symfony · Aug 30, 2024 · Reviewed Nov 9

  Symfony Validator: Values Ending in a Newline Pass Regex-Based Checks

  Lets values with a trailing newline pass constraints such as Email, Url, Date and Time that Symfony checks with a regular expression.

  Fixed in 6.4.11 and 5.4.43 · 1 older release

• low Symfony · Jul 17, 2024 · Reviewed Nov 10

  Symfony Security::login() Skips the Firewall's Custom User Checker

  Lets accounts a firewall's custom user_checker would reject log in anyway when the app logs them in with Security::login().

  Fixed in 6.4.10 · 2 older releases

• medium Symfony · May 30, 2024 · Reviewed Nov 10

  Symfony2 getClientIp(): Faked Client IPs Can Get Past IP-Based Access Rules

  Lets a client fake their IP address in Symfony 2.0 and 2.1 apps that call Request::trustProxyData() and use getClientIp() for access control.

  Only affects branches that no longer get security fixes

• high Symfony · May 30, 2024 · Reviewed Nov 10

  Symfony 2.0: XML Entity Expansion Lets Small Documents Exhaust Memory

  Lets an attacker use up a server's memory with one small XML document in Symfony 2.0 apps that parse untrusted XML.

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 10, 2023 · Reviewed Nov 10

  Symfony Webhook: WebhookController Error Message Allows XSS

  Lets an attacker craft a link that runs JavaScript on your site through the Webhook component's error response, in Symfony 6.3 before 6.3.8.

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 10, 2023 · Reviewed Nov 10

  Symfony Security: Session ID Not Renewed When a Partial Login Completes

  Allows session fixation, because the session ID wasn't regenerated when a partly authenticated login became fully authenticated.

  Fixed in 5.4.31 · 1 older release

• medium Symfony · Nov 10, 2023 · Reviewed Nov 10

  Symfony Twig Bridge: CodeExtension Filters Can Output Unescaped HTML

  Allows cross-site scripting when untrusted input reaches some CodeExtension Twig filters, which marked their output safe without escaping it.

  Fixed in 5.4.31 · 2 older releases

• medium Symfony · Feb 1, 2023

  CVE-2022-24894: Prevent storing cookie headers in HttpCache

  Fixed in 5.4.20 · 4 older releases

• medium Symfony · Feb 1, 2023

  CVE-2022-24895: Possible CSRF token fixation

  Fixed in 5.4.20 · 4 older releases

• high Symfony · May 14, 2022

  Symfony Host Header Injection

  No fixed release listed yet

• high Symfony · Jan 29, 2022

  CVE-2022-23601: CSRF token missing in forms

  Fixed in 5.4.4 · 2 older releases

• medium Symfony · Nov 15, 2021

  CVE-2021-41270: Prevent CSV Injection via formulas

  Only affects branches that no longer get security fixes

• medium Symfony · Oct 23, 2021

  CVE-2021-41268: Remember me cookie persistance after password changes

  Only affects branches that no longer get security fixes

• medium Symfony · Oct 9, 2021

  CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request

  Only affects branches that no longer get security fixes

• medium Symfony · Jun 17, 2021

  CVE-2021-32693: Authentication granted to all firewalls instead of just one

  Only affects branches that no longer get security fixes

• medium Symfony · May 12, 2021

  CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms

  Only affects branches that no longer get security fixes

• high Symfony · Sep 2, 2020

  CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient

  Only affects branches that no longer get security fixes

• low Symfony · Mar 30, 2020

  CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header

  Only affects branches that no longer get security fixes

• medium Symfony · Mar 30, 2020

  CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler

  Only affects branches that no longer get security fixes

• high Symfony · Mar 30, 2020

  CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy

  Only affects branches that no longer get security fixes

• high Symfony · Nov 13, 2019

  CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

  Only affects branches that no longer get security fixes

• critical Symfony · Nov 13, 2019

  CVE-2019-11325: Fix escaping of strings in VarExporter

  Only affects branches that no longer get security fixes

• high Symfony · Nov 13, 2019

  CVE-2019-18887: Use constant time comparison in UriSigner

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 13, 2019

  CVE-2019-18886: Prevent user enumeration using switch user functionality

  Only affects branches that no longer get security fixes

• critical Symfony · Nov 13, 2019

  CVE-2019-18889: Forbid serializing AbstractAdapter and TagAwareAdapter instances

  Only affects branches that no longer get security fixes

• critical Symfony · Apr 16, 2019

  CVE-2019-10910: Check service IDs are valid

  Only affects branches that no longer get security fixes

• medium Symfony · Apr 16, 2019

  CVE-2019-10909: Escape validation messages in the PHP templating engine

  Only affects branches that no longer get security fixes

• high Symfony · Apr 16, 2019

  CVE-2019-10912: Prevent destructors with side-effects from being unserialized

  Only affects branches that no longer get security fixes

• high Symfony · Apr 16, 2019

  CVE-2019-10911: Add a separator in the remember me cookie hash

  Only affects branches that no longer get security fixes

• critical Symfony · Apr 16, 2019

  CVE-2019-10913: Reject invalid HTTP method overrides

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 6, 2018

  CVE-2018-19790: Open Redirect Vulnerability on login

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 6, 2018

  CVE-2018-19789: Temporary uploaded file path disclosure

  Only affects branches that no longer get security fixes

• medium Symfony · Aug 1, 2018

  CVE-2018-14773: Remove support for legacy and risky HTTP headers

  Only affects branches that no longer get security fixes

• critical Symfony · May 25, 2018

  CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password

  Only affects branches that no longer get security fixes

• medium Symfony · May 25, 2018

  CVE-2018-11386: Denial of service when using PDOSessionHandler

  Only affects branches that no longer get security fixes

• high Symfony · May 25, 2018

  CVE-2018-11406: CSRF Token Fixation

  Only affects branches that no longer get security fixes

• high Symfony · May 25, 2018

  CVE-2018-11385: Session Fixation Issue for Guard Authentication

  Only affects branches that no longer get security fixes

• medium Symfony · May 25, 2018

  CVE-2018-11408: Open redirect vulnerability on security handlers

  Only affects branches that no longer get security fixes

• high Symfony · Nov 16, 2017

  CVE-2017-16654: Intl bundle readers breaking out of paths

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 16, 2017

  CVE-2017-16652: Open redirect vulnerability on security handlers

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 16, 2017

  CVE-2017-16790: Ensure that submitted data are uploaded files

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 16, 2017

  CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS

  Only affects branches that no longer get security fixes

• critical Symfony · Jul 17, 2017

  CVE-2017-11365: Empty passwords validation issue

  Only affects branches that no longer get security fixes

• critical Symfony · May 9, 2016

  CVE-2016-2403: Unauthorized access on a misconfigured Ldap server when using an empty password

  Only affects branches that no longer get security fixes

• high Symfony · May 9, 2016

  CVE-2016-4423: Large username storage in session

  Only affects branches that no longer get security fixes

• high Symfony · Jan 14, 2016

  CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails

  Only affects branches that no longer get security fixes

• low Symfony · Nov 23, 2015

  CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature

  Only affects branches that no longer get security fixes

• high Symfony · Nov 23, 2015

  CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service

  Only affects branches that no longer get security fixes

• medium Symfony · May 26, 2015

  CVE-2015-4050: ESI unauthorized access

  Only affects branches that no longer get security fixes

• medium Symfony · Apr 1, 2015

  Unsafe methods in the Request class

  Only affects branches that no longer get security fixes

• medium Symfony · Apr 1, 2015

  Esi Code Injection

  Only affects branches that no longer get security fixes

• high Symfony · Sep 3, 2014

  CSRF vulnerability in the Web Profiler

  Only affects branches that no longer get security fixes

• high Symfony · Sep 3, 2014

  Direct access of ESI URLs behind a trusted proxy

  Only affects branches that no longer get security fixes

• medium Symfony · Sep 3, 2014

  Security issue when parsing the Authorization header

  Only affects branches that no longer get security fixes

• high Symfony · Sep 3, 2014

  Denial of service with a malicious HTTP Host header

  Only affects branches that no longer get security fixes

• high Symfony · Jul 15, 2014

  Code injection in the way Symfony implements translation caching in FrameworkBundle

  Only affects branches that no longer get security fixes

• medium Symfony · Oct 10, 2013

  Possible DOS attack with long user-submitted passwords

  Only affects branches that no longer get security fixes

• medium Symfony · Aug 17, 2013

  Request::getHost() poisoning

  Only affects branches that no longer get security fixes

• high Symfony · Aug 17, 2013

  Validation metadata serialization and loss of information

  Only affects branches that no longer get security fixes

• high Symfony · Jan 15, 2013

  Ability to enable/disable object support in YAML parsing and dumping

  Only affects branches that no longer get security fixes

• high Symfony · Jan 15, 2013

  Ability to enable/disable PHP parsing in Yaml::parse()

  Only affects branches that no longer get security fixes

• medium Symfony · Dec 19, 2012

  Code execution vulnerability via the "internal" routes

  Only affects branches that no longer get security fixes

• critical Symfony · Aug 28, 2012

  Request::getClientIp() when the trust proxy mode is enabled

  Only affects branches that no longer get security fixes

• medium Symfony · Mar 19, 2012

  Routes behind a firewall are accessible even when not logged in

  Only affects branches that no longer get security fixes

• critical Symfony · Feb 24, 2012

  XML decoding attack vector through external entities

  Only affects branches that no longer get security fixes

• medium Symfony · Nov 16, 2011

  Vulnerability in the EntityUserProvider as provided in the Doctrine bridge

  Only affects branches that no longer get security fixes