DEBIAN-CVE-2026-45754

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-45754
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45754.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-45754
Upstream
Published
2026-07-14T19:17:07Z
Modified
2026-09-14T17:03:42Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

References

Affected packages

Debian:13 / symfony

Package

Name
symfony
Purl
pkg:deb/debian/symfony?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.4.41+dfsg-0+deb13u1

Affected versions

6.*
6.4.21+dfsg-2
6.4.21+dfsg-2+deb13u1
6.4.24+dfsg-1
6.4.25+dfsg-1
6.4.40+dfsg-0+deb13u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45754.json"

Debian:14 / symfony

Package

Name
symfony
Purl
pkg:deb/debian/symfony?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.4.12+dfsg-1

Affected versions

6.*
6.4.21+dfsg-2
6.4.24+dfsg-1
6.4.25+dfsg-1
7.*
7.0.4+dfsg-1
7.0.5+dfsg-1
7.0.6+dfsg-1
7.0.7+dfsg-1
7.1.0~beta1+dfsg-1
7.1.0~rc1+dfsg-1
7.1.2+dfsg-1
7.1.3+dfsg-1
7.1.4+dfsg-1
7.1.5+dfsg-1
7.2.0~beta1+dfsg-1
7.2.0~beta2+dfsg-1
7.2.0~rc1+dfsg-1
7.2.1+dfsg-1
7.2.2+dfsg-1
7.2.3+dfsg-1
7.2.4+dfsg-1
7.2.5+dfsg-1
7.2.6-1
7.3.0~beta1+dfsg-1
7.3.0~beta2+dfsg-1
7.3.0~rc1+dfsg-1
7.3.0+dfsg-1
7.3.1+dfsg-1
7.3.2+dfsg-1
7.3.3+dfsg-1
7.3.4+dfsg-1
7.3.5-1
7.4.0~beta1-1
7.4.0~beta1-2
7.4.0~beta2+dfsg-1
7.4.0~beta2+dfsg-2
7.4.0~beta2+dfsg-3
7.4.0~rc1+dfsg-1
7.4.0~rc2+dfsg-1
7.4.0~rc3+dfsg-1
7.4.0+dfsg-1
7.4.0+dfsg-2
7.4.2+dfsg-1
7.4.2+dfsg-2
7.4.3+dfsg-1
7.4.4+dfsg-1
7.4.5+dfsg-1
7.4.6+dfsg-1
7.4.6+dfsg-2
7.4.7+dfsg-1
7.4.8+dfsg-1
7.4.9+dfsg-1
7.4.10+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45754.json"