Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/friendsofsymfony/user-bundle@1.3.2
purl pkg:composer/friendsofsymfony/user-bundle@1.3.2
Next non-vulnerable version 1.3.5
Latest non-vulnerable version 1.3.5
Risk 3.1
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-ky5a-sata-5yf6
Aliases:
CVE-2013-5750
GHSA-9mpf-g3fc-9rgv
Uncontrolled Resource Consumption The login form in the FriendsOfSymfony FOSUserBundle bundle for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation.
1.3.3
Affected by 1 other vulnerability.
VCID-yyyq-za39-r3hh
Aliases:
GHSA-pjx8-984p-7p3x
FOSUserBundle Entropy is lost in the TokenGenerator Because of the usage of base_convert which looses precision for large inputs, the entropy of tokens generated by FOSUserBundle for the email confirmation and password resetting is lost. This makes these tokens much less random than they are expected to be, and so not cryptographically safe.
1.3.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-06T04:54:52.100639+00:00 GitLab Importer Affected by VCID-yyyq-za39-r3hh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/friendsofsymfony/user-bundle/GHSA-pjx8-984p-7p3x.yml 38.6.0
2026-06-04T20:03:44.983759+00:00 GitLab Importer Affected by VCID-ky5a-sata-5yf6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/friendsofsymfony/user-bundle/CVE-2013-5750.yml 38.6.0