Search for packages
| purl | pkg:composer/symfony/symfony@6.4.41 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-2v3c-qxhr-7vpv
Aliases: CVE-2026-109413 |
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process ### Description `Yaml\Parser::lexInlineStructure()` recursed through … |
Vulnerable |
|
GHSA-r925-mgvr-h9cc
Aliases: CVE-2026-108082 |
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header ### Description `HeaderUtils::split()` parsed header values with a pattern whose … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-38cx-cq6f-5755
|
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient ### Description `Symfony\Component\HttpClient\NoPrivateNetworkHttpClient` is documented as … |
CVE-2026-48736
|
|
GHSA-v3wm-qf9p-c549
|
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense ### Description `Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse()` rejects … |
CVE-2026-48760
|
|
GHSA-6h46-9jf5-q59x
|
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured … |
CVE-2026-48489
|
|
GHSA-h5x3-xfc9-m39h
|
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization … |
CVE-2026-48784
|
|
GHSA-x5qj-865h-mgvm
|
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes ### Description `Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme … |
CVE-2026-48761
|