Symfony vulnerabilities
66 CVEs and advisories name Symfony as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118514Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls
- CVE-2026-49215Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
- CVE-2026-49216Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
- CVE-2026-49211Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
- CVE-2026-49208Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
- CVE-2026-49210Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
- CVE-2026-49212Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
- CVE-2026-49209Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
- CVE-2026-46644symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- CVE-2026-48761Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
- CVE-2026-48747Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
- CVE-2026-48489Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
- CVE-2026-48760Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
- CVE-2026-48736Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
- CVE-2026-48784Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- CVE-2026-45068Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
- CVE-2026-47212Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
- CVE-2026-45071Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
- CVE-2026-45755Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
- CVE-2026-45754Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
- CVE-2026-45305Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
- CVE-2026-45304Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
- CVE-2026-45069Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
- CVE-2026-45133Symfony: [Yaml] Harden the parser when handling untrusted input
- CVE-2026-45075Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
- CVE-2026-47767Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
- CVE-2026-45064Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
- CVE-2026-45063Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
- CVE-2026-45070Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
- CVE-2026-45073Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix