Packagist

GHSA-h5x3-xfc9-m39h

Packagist/symfony/routing
Packagist/symfony/symfony

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization 15 Jun

Fix available
Severity - 6.9 (Medium)

GHSA-v3wm-qf9p-c549

Packagist/symfony/html-sanitizer
Packagist/symfony/symfony

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense 15 Jun

Fix available

GHSA-rrj9-5q2j-4gvr

Packagist/symfony/mailomat-mailer
Packagist/symfony/symfony

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade 15 Jun

Fix available

GHSA-38cx-cq6f-5755

Packagist/symfony/http-client
Packagist/symfony/http-foundation
Packagist/symfony/symfony

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient 15 Jun

Fix available
Severity - 6.3 (Medium)

GHSA-6h46-9jf5-q59x

Packagist/symfony/security-http
Packagist/symfony/symfony

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes 15 Jun

Fix available

GHSA-x5qj-865h-mgvm

Packagist/symfony/html-sanitizer
Packagist/symfony/symfony

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes 15 Jun

Fix available
Severity - 5.3 (Medium)

GHSA-fqc7-9xjw-jrh3

Packagist/symfony/runtime
Packagist/symfony/symfony

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch 09 Jun

Fix available
Severity - 6.9 (Medium)

GHSA-55rj-x2vc-4whq

Packagist/symfony/symfony
Packagist/symfony/twilio-notifier

Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification 29 May

Fix available
Severity - 4.6 (Medium)

GHSA-8v8v-g73j-492j

Packagist/symfony/json-path
Packagist/symfony/symfony

Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS 28 May

Fix available
Severity - 2.7 (Low)

GHSA-59f3-vp2f-mp9w

Packagist/symfony/mailtrap-mailer
Packagist/symfony/symfony

Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection 28 May

Fix available
Severity - 6.6 (Medium)

GHSA-64hg-93w9-fc35

Packagist/symfony/lox24-notifier
Packagist/symfony/mailjet-mailer
Packagist/symfony/symfony

Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection 28 May

Fix available
Severity - 6.6 (Medium)

GHSA-hhg7-c65m-h7ff

Packagist/symfony/html-sanitizer
Packagist/symfony/symfony

Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) 28 May

Fix available
Severity - 1.2 (Low)

GHSA-9frc-8383-795m

Packagist/symfony/symfony
Packagist/symfony/yaml

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex 27 May

Fix available
Severity - 2.7 (Low)

GHSA-4qpc-3hr4-r2p4

Packagist/symfony/symfony
Packagist/symfony/yaml

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") 27 May

Fix available
Severity - 2.7 (Low)

GHSA-c2p3-7m5p-cv8x

Packagist/symfony/symfony
Packagist/symfony/yaml

Symfony hardened the parser when handling untrusted input 27 May

Fix available
Severity - 2.7 (Low)

GHSA-m7v2-7gxm-vc2v

Packagist/symfony/monolog-bridge
Packagist/symfony/symfony

Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener 27 May

Fix available
Severity - 8.1 (High)

Vulnerabilities