/
← Voltar ao feed
medium

CERT-FR: Multiple Symfony vulnerabilities in expression-language, http-foundation, symfony and yaml allow remote denial of service

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 21:00 · coletado há 13 horas

CERT-FR advisory CERTFR-2026-AVI-1324, published 15 October 2026, reports multiple vulnerabilities in Symfony components that allow a remote attacker to cause a denial of service. The affected components are symfony/expression-language, symfony/http-foundation, symfony/symfony and symfony/yaml, across the 5.4, 6.x, 7.x and 8.x branches. The advisory is based on three Symfony GitHub security advisories dated 15 October 2026 and references CVE-2026-108082, CVE-2026-109413 and CVE-2026-109449. It does not state whether any flaw is exploited in the wild, and gives no technical detail, per-CVE severity, IOCs or attribution.

Technical Details

  • symfony/expression-language: affected before 5.4.54, before 6.4.48 (6.x), before 7.4.21 (7.x) and before 8.1.9 (8.x).
  • symfony/http-foundation: affected before 5.4.54, before 6.4.46 (6.x), before 7.4.19 (7.x) and before 8.1.7 (8.x).
  • symfony/symfony: affected before 5.4.54, before 6.4.48 (6.x), before 7.4.21 (7.x) and before 8.1.9 (8.x).
  • symfony/yaml: affected before 5.4.54, before 6.4.45 (6.x), before 7.4.18 (7.x) and before 8.1.6 (8.x).
  • Vendor advisories: GHSA-2v3c-qxhr-7vpv, GHSA-7rpj-w9pf-39rr and GHSA-r925-mgvr-h9cc.
  • The advisory does not map individual CVEs to components.

Remediation

  • Consult the Symfony security advisories (GHSA-2v3c-qxhr-7vpv, GHSA-7rpj-w9pf-39rr, GHSA-r925-mgvr-h9cc) and upgrade to the fixed versions listed there.
  • Update the affected Symfony components, including those pulled in through the full symfony/symfony package, to versions at or above the fixed releases for each branch.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple Symfony vulnerabilities in expression-language, http-foundation, symfony and yaml allow remote denial of service

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1324, published 15 October 2026, reports multiple vulnerabilities in Symfony components that allow a remote attacker to cause a denial of service. The affected components are symfony/expression-language, symfony/http-foundation, symfony/symfony and symfony/yaml, across the 5.4, 6.x, 7.x and 8.x branches. The advisory is based on three Symfony GitHub security advisories dated 15 October 2026 and references CVE-2026-108082, CVE-2026-109413 and CVE-2026-109449. It does not state whether any flaw is exploited in the wild, and gives no technical detail, per-CVE severity, IOCs or attribution.

    Technical Details

    • symfony/expression-language: affected before 5.4.54, before 6.4.48 (6.x), before 7.4.21 (7.x) and before 8.1.9 (8.x).
    • symfony/http-foundation: affected before 5.4.54, before 6.4.46 (6.x), before 7.4.19 (7.x) and before 8.1.7 (8.x).
    • symfony/symfony: affected before 5.4.54, before 6.4.48 (6.x), before 7.4.21 (7.x) and before 8.1.9 (8.x).
    • symfony/yaml: affected before 5.4.54, before 6.4.45 (6.x), before 7.4.18 (7.x) and before 8.1.6 (8.x).
    • Vendor advisories: GHSA-2v3c-qxhr-7vpv, GHSA-7rpj-w9pf-39rr and GHSA-r925-mgvr-h9cc.
    • The advisory does not map individual CVEs to components.

    Remediation

    • Consult the Symfony security advisories (GHSA-2v3c-qxhr-7vpv, GHSA-7rpj-w9pf-39rr, GHSA-r925-mgvr-h9cc) and upgrade to the fixed versions listed there.
    • Update the affected Symfony components, including those pulled in through the full symfony/symfony package, to versions at or above the fixed releases for each branch.