CVE-2016-4423

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-4423
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4423.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-4423
Aliases
Downstream
Published
2016-06-01T22:59:02.457Z
Modified
2026-04-10T03:52:21.238682Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.

References

Affected packages

Git / github.com/symfony/symfony

Affected ranges

Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7bcb5deb31d2ba005dcf97f731fac64e46922f95
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9975b1eca3de4db792a2c3e4e16f676a4aadcd46
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
932b6e7499c670f4db6d0b871477a4a3ca161e74
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
969d709ad428076bf1084e386dc26dd904d9fb84
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a9af4708b4bb650c4897e9b8dfbfbdb2ea5f0486
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1fdf23fe28876844b887b0e1935c9adda43ee645
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
619528a274647cffc1792063c3ea04c4fa8266a0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
66b2e9662c44d478b69e48278aa54079a006eb42
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
cc69dbd24b4b2e6de60b2414ef95da2794f459a2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ad264021e44a5aaa132f16aef69f92e56795683e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d3646cc6875c214d211001e0673ec9e91b5f2da7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9a3b6bf6ebee49370aaf15abc1bdeb4b1986a67d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
66c99826ce3d4392aa1fd08564946cb4277e3897
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9edf2430f1846602844d2b434f26389a018f494f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5615b92cd452cd54f1433a3f53de87c096a1107f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8956ed50a44c5c4e02f2176c0773e24487477b09
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f3e6a82bcbea4db3b56df08e491e20a1faae82b5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7a9a5fce7ce6e448e527f635463dda00761e12c2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9e14f9f4869c19188a376eab61d9a1c1f1fee347
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
39ddd2383f4113cf67f8b28cde2c9d3fa340c3c2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
eb2a4f5f7a09fc4ce7a74ae883a8cf8a279614f5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
979d7323716fec847508eac3e62d59b117612a6e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
18c3d4f356931a5b6a4afb0cc679a2c58931c795
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
09ae53562ce8b7842206efa217ec81442975f055
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4e17cb2ecb3fd637097ebeb871fc0e2cbdd5e7ff
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
10c83b58fbb42be516377de54962a758695ad964
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2e913a829cfbbf9cb38b321bdff1806b44b192eb
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.40"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0-RC6
v2.0.0BETA1
v2.0.0BETA2
v2.0.0BETA3
v2.0.0BETA4
v2.0.0BETA5
v2.0.0PR8
v2.1.0
v2.1.0-BETA1
v2.1.0-BETA2
v2.1.0-BETA3
v2.1.0-BETA4
v2.1.0-RC1
v2.1.0-RC2
v2.2.0-BETA1
v2.2.0-BETA2
v2.3.0
v2.3.0-BETA1
v2.3.0-BETA2
v2.3.0-RC1
v2.3.1
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.28
v2.3.29
v2.3.3
v2.3.30
v2.3.31
v2.3.32
v2.3.33
v2.3.34
v2.3.35
v2.3.36
v2.3.37
v2.3.38
v2.3.39
v2.3.4
v2.3.40
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0-BETA1
v2.4.0-BETA2
v2.5.0-BETA1
v2.5.0-BETA2
v2.6.0-BETA1
v2.7.0
v2.7.0-BETA1
v2.7.0-BETA2
v2.7.1
v2.7.10
v2.7.11
v2.7.12
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.0-BETA1
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v3.*
v3.0.0
v3.0.0-BETA1
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.2.0-BETA1
v3.2.0-RC1
v3.3.0-BETA1
v4.*
v4.0.0-BETA1
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.2.0-BETA1
v4.2.0-BETA2
v4.3.0-BETA1
v5.*
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.1.0-BETA1
v5.2.0-BETA1
v5.2.0-BETA2
v5.2.0-BETA3
v5.3.0-BETA1
v5.3.0-BETA2
v5.3.0-BETA3
v5.3.0-BETA4
v6.*
v6.0.0-BETA1
v6.0.0-BETA2
v6.0.0-BETA3
v6.0.0-RC1
v6.1.0-BETA1
v6.1.0-BETA2
v6.1.0-RC1
v6.2.0-BETA1
v6.2.0-BETA2
v6.2.0-BETA3
v6.3.0-BETA1
v6.3.0-BETA2
v6.3.0-BETA3
v6.3.0-RC1
v7.*
v7.0.0-BETA1
v7.0.0-BETA2
v7.0.0-BETA3
v7.0.0-RC1
v7.1.0-BETA1
v7.1.0-RC1
v7.2.0-BETA1
v7.2.0-BETA2
v7.2.0-RC1
v7.3.0-BETA1
v7.3.0-BETA2
v7.3.0-RC1
v8.*
v8.0.0
v8.0.0-BETA1
v8.0.0-BETA2
v8.0.0-RC1
v8.0.0-RC2
v8.0.0-RC3
Other
vPR3
vPR4
vPR5
vPR6
vPR8
vPR9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4423.json"