CERT-FR Advisory: Multiple Vulnerabilities Patched in Symfony Framework Components
CERT-FR published advisory CERTFR-2026-AVI-1460 on 04 November 2026 detailing multiple vulnerabilities in Symfony components, including filesystem, http-client, http-foundation, json-path, routing, security-http, serializer, symfony, and yaml packages. The flaws can lead to a breach of data confidentiality, a security policy bypass, and a remote denial of service. Affected versions span the 5.4, 6.x, 7.x, and 8.x branches, with fixes available in 5.4.56, 6.4.50, 7.4.23, and 8.1.11 (and 7.4.23/8.1.11 for json-path). CERT-FR references nine Symfony GitHub security advisories and one CVE, directing administrators to the vendor bulletins for patches.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1460 covers multiple vulnerabilities in Symfony components: filesystem, http-client, http-foundation, json-path, routing, security-http, serializer, symfony and yaml. Depending on the flaw, an attacker can cause a remote denial of service, breach data confidentiality or bypass a security policy. The advisory does not say which flaw maps to which component, nor what access or configuration an attacker needs. It lists one CVE, CVE-2026-118516, and nine GitHub advisories. Affected: all versions before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23 and 8.x before 8.1.11. For json-path, only 7.3.0 up to before 7.4.23 and 8.x before 8.1.11. Fixed in 5.4.56, 6.4.50, 7.4.23 and 8.1.11.
Onde está
The articles name only the affected Symfony packages and the nine vendor advisories published on 04 November 2026 (GHSA-3h27-hjv7-fqjx, GHSA-5mx8-mwrp-5693, GHSA-6prc-h956-hxjq, GHSA-8f57-m8wj-x65w, GHSA-c7hm-wqwp-f9v8, GHSA-cpww-5vpx-72x7, GHSA-hwfg-qwvh-2wfx, GHSA-pxj9-jh84-vhm5, GHSA-xqw3-x93m-887x); no file or function is given.
Como foi descoberta
The articles do not say who found the flaws or how. They only show that Symfony published nine GitHub security advisories on 04 November 2026 and that CERT-FR issued its advisory the same day, pointing administrators to the vendor bulletins for patches. They report no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 16:18.
Detalhes técnicos
- Impact includes confidentiality breach, security policy bypass, and remote denial of service across multiple Symfony components.
- Affected packages: filesystem, http-client, http-foundation, json-path, routing, security-http, serializer, symfony, yaml.
- Vulnerable versions: pre-5.4.56, 6.x pre-6.4.50, 7.x pre-7.4.23, 8.x pre-8.1.11 (json-path only from 7.3.0 to pre-7.4.23 and pre-8.1.11 for 8.x).
Remediação
- Update to Symfony 5.4.56, 6.4.50, 7.4.23, or 8.1.11 as applicable, per the referenced GHSA advisories dated 04 November 2026.
Linha do tempo
-
CERT-FR Advisory: Multiple Vulnerabilities Patched in Symfony Framework Components
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1460 on 04 November 2026 detailing multiple vulnerabilities in Symfony components, including filesystem, http-client, http-foundation, json-path, routing, security-http, serializer, symfony, and yaml packages. The flaws can lead to a breach of data confidentiality, a security policy bypass, and a remote denial of service. Affected versions span the 5.4, 6.x, 7.x, and 8.x branches, with fixes available in 5.4.56, 6.4.50, 7.4.23, and 8.1.11 (and 7.4.23/8.1.11 for json-path). CERT-FR references nine Symfony GitHub security advisories and one CVE, directing administrators to the vendor bulletins for patches.
Technical Details
- Impact includes confidentiality breach, security policy bypass, and remote denial of service across multiple Symfony components.
- Affected packages: filesystem, http-client, http-foundation, json-path, routing, security-http, serializer, symfony, yaml.
- Vulnerable versions: pre-5.4.56, 6.x pre-6.4.50, 7.x pre-7.4.23, 8.x pre-8.1.11 (json-path only from 7.3.0 to pre-7.4.23 and pre-8.1.11 for 8.x).
Remediation
- Update to Symfony 5.4.56, 6.4.50, 7.4.23, or 8.1.11 as applicable, per the referenced GHSA advisories dated 04 November 2026.