Search for packages
| purl | pkg:composer/symfony/symfony@5.4.53 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-2v3c-qxhr-7vpv
Aliases: CVE-2026-109413 |
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process ### Description `Yaml\Parser::lexInlineStructure()` recursed through … |
Not vulnerable |
|
GHSA-r925-mgvr-h9cc
Aliases: CVE-2026-108082 |
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header ### Description `HeaderUtils::split()` parsed header values with a pattern whose … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-38cx-cq6f-5755
|
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient ### Description `Symfony\Component\HttpClient\NoPrivateNetworkHttpClient` is documented as … |
CVE-2026-48736
|
|
GHSA-6h46-9jf5-q59x
|
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured … |
CVE-2026-48489
|
|
GHSA-h5x3-xfc9-m39h
|
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization … |
CVE-2026-48784
|