CVE-2016-4423

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-4423
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4423.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-4423
Aliases
Downstream
Published
2016-06-01T22:59:02.457Z
Modified
2026-07-08T05:48:36.298421893Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / github.com/symfony/security-http

Affected ranges

Type
GIT
Repo
https://github.com/symfony/security-http
Events
Introduced
de2f3d51160791ef254010953dbde178fee9845f
Last affected
93431d2843a498bb3c1e84bae4cf8f321efd9e01
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.0"
        },
        {
            "introduced": "2.7.1"
        },
        {
            "last_affected": "2.7.1"
        },
        {
            "introduced": "2.7.2"
        },
        {
            "last_affected": "2.7.2"
        },
        {
            "introduced": "2.7.3"
        },
        {
            "last_affected": "2.7.3"
        },
        {
            "introduced": "2.7.4"
        },
        {
            "last_affected": "2.7.4"
        },
        {
            "introduced": "2.7.5"
        },
        {
            "last_affected": "2.7.5"
        },
        {
            "introduced": "2.7.6"
        },
        {
            "last_affected": "2.7.6"
        },
        {
            "introduced": "2.7.7"
        },
        {
            "last_affected": "2.7.7"
        },
        {
            "introduced": "2.7.8"
        },
        {
            "last_affected": "2.7.8"
        },
        {
            "introduced": "2.7.9"
        },
        {
            "last_affected": "2.7.9"
        },
        {
            "introduced": "2.7.10"
        },
        {
            "last_affected": "2.7.10"
        },
        {
            "introduced": "2.7.11"
        },
        {
            "last_affected": "2.7.11"
        },
        {
            "introduced": "2.7.12"
        },
        {
            "last_affected": "2.7.12"
        },
        {
            "introduced": "2.8.0"
        },
        {
            "last_affected": "2.8.0"
        },
        {
            "introduced": "2.8.1"
        },
        {
            "last_affected": "2.8.1"
        },
        {
            "introduced": "2.8.2"
        },
        {
            "last_affected": "2.8.2"
        },
        {
            "introduced": "2.8.3"
        },
        {
            "last_affected": "2.8.3"
        },
        {
            "introduced": "2.8.4"
        },
        {
            "last_affected": "2.8.4"
        },
        {
            "introduced": "2.8.5"
        },
        {
            "last_affected": "2.8.5"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "3.0.1"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "3.0.2"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "introduced": "3.0.3"
        },
        {
            "last_affected": "3.0.3"
        },
        {
            "introduced": "3.0.4"
        },
        {
            "last_affected": "3.0.4"
        },
        {
            "introduced": "3.0.5"
        },
        {
            "last_affected": "3.0.5"
        }
    ],
    "cpe": [
        "cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.5:*:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*
2.7.0
2.7.1
2.7.10
2.7.11
2.7.12
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
3.*
3.0.0
3.0.1
3.0.2
3.0.4
3.0.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4423.json"

Git / github.com/symfony/symfony

Affected ranges

Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7bcb5deb31d2ba005dcf97f731fac64e46922f95
Introduced
9975b1eca3de4db792a2c3e4e16f676a4aadcd46
Last affected
10c83b58fbb42be516377de54962a758695ad964
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.40"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.0"
        },
        {
            "introduced": "2.7.1"
        },
        {
            "last_affected": "2.7.1"
        },
        {
            "introduced": "2.7.2"
        },
        {
            "last_affected": "2.7.2"
        },
        {
            "introduced": "2.7.3"
        },
        {
            "last_affected": "2.7.3"
        },
        {
            "introduced": "2.7.4"
        },
        {
            "last_affected": "2.7.4"
        },
        {
            "introduced": "2.7.5"
        },
        {
            "last_affected": "2.7.5"
        },
        {
            "introduced": "2.7.6"
        },
        {
            "last_affected": "2.7.6"
        },
        {
            "introduced": "2.7.7"
        },
        {
            "last_affected": "2.7.7"
        },
        {
            "introduced": "2.7.8"
        },
        {
            "last_affected": "2.7.8"
        },
        {
            "introduced": "2.7.9"
        },
        {
            "last_affected": "2.7.9"
        },
        {
            "introduced": "2.7.10"
        },
        {
            "last_affected": "2.7.10"
        },
        {
            "introduced": "2.7.11"
        },
        {
            "last_affected": "2.7.11"
        },
        {
            "introduced": "2.7.12"
        },
        {
            "last_affected": "2.7.12"
        },
        {
            "introduced": "2.8.0"
        },
        {
            "last_affected": "2.8.0"
        },
        {
            "introduced": "2.8.1"
        },
        {
            "last_affected": "2.8.1"
        },
        {
            "introduced": "2.8.2"
        },
        {
            "last_affected": "2.8.2"
        },
        {
            "introduced": "2.8.3"
        },
        {
            "last_affected": "2.8.3"
        },
        {
            "introduced": "2.8.4"
        },
        {
            "last_affected": "2.8.4"
        },
        {
            "introduced": "2.8.5"
        },
        {
            "last_affected": "2.8.5"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "3.0.1"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "3.0.2"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "introduced": "3.0.3"
        },
        {
            "last_affected": "3.0.3"
        },
        {
            "introduced": "3.0.4"
        },
        {
            "last_affected": "3.0.4"
        },
        {
            "introduced": "3.0.5"
        },
        {
            "last_affected": "3.0.5"
        }
    ],
    "cpe": [
        "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.5:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

2.*
2.7.0
2.7.1
2.7.10
2.7.11
2.7.12
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0-RC6
v2.0.0BETA1
v2.0.0BETA2
v2.0.0BETA3
v2.0.0BETA4
v2.0.0BETA5
v2.0.0PR8
v2.1.0
v2.1.0-BETA1
v2.1.0-BETA2
v2.1.0-BETA3
v2.1.0-BETA4
v2.1.0-RC1
v2.1.0-RC2
v2.2.0-BETA1
v2.2.0-BETA2
v2.3.0
v2.3.0-BETA1
v2.3.0-BETA2
v2.3.0-RC1
v2.3.1
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.28
v2.3.29
v2.3.3
v2.3.30
v2.3.31
v2.3.32
v2.3.33
v2.3.34
v2.3.35
v2.3.36
v2.3.37
v2.3.38
v2.3.39
v2.3.4
v2.3.40
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0-BETA1
v2.4.0-BETA2
v2.5.0-BETA1
v2.5.0-BETA2
v2.6.0-BETA1
v3.*
v3.0.0
v3.0.0-BETA1
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
Other
vPR3
vPR4
vPR5
vPR6
vPR8
vPR9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4423.json"