DEBIAN-CVE-2026-45756
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-45756
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45756.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-45756
- Upstream
- Published
- 2026-07-14T18:17:17Z
- Modified
- 2026-09-14T17:03:42Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause denial of service. This issue is fixed in versions 7.4.12 and 8.0.12.
- References
Affected packages
Debian:14 / symfony
Package
- Name
- symfony
- Purl
- pkg:deb/debian/symfony?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.4.12+dfsg-1
Affected versions
6.*
6.4.21+dfsg-2
6.4.24+dfsg-1
6.4.25+dfsg-1
7.*
7.0.4+dfsg-1
7.0.5+dfsg-1
7.0.6+dfsg-1
7.0.7+dfsg-1
7.1.0~beta1+dfsg-1
7.1.0~rc1+dfsg-1
7.1.2+dfsg-1
7.1.3+dfsg-1
7.1.4+dfsg-1
7.1.5+dfsg-1
7.2.0~beta1+dfsg-1
7.2.0~beta2+dfsg-1
7.2.0~rc1+dfsg-1
7.2.1+dfsg-1
7.2.2+dfsg-1
7.2.3+dfsg-1
7.2.4+dfsg-1
7.2.5+dfsg-1
7.2.6-1
7.3.0~beta1+dfsg-1
7.3.0~beta2+dfsg-1
7.3.0~rc1+dfsg-1
7.3.0+dfsg-1
7.3.1+dfsg-1
7.3.2+dfsg-1
7.3.3+dfsg-1
7.3.4+dfsg-1
7.3.5-1
7.4.0~beta1-1
7.4.0~beta1-2
7.4.0~beta2+dfsg-1
7.4.0~beta2+dfsg-2
7.4.0~beta2+dfsg-3
7.4.0~rc1+dfsg-1
7.4.0~rc2+dfsg-1
7.4.0~rc3+dfsg-1
7.4.0+dfsg-1
7.4.0+dfsg-2
7.4.2+dfsg-1
7.4.2+dfsg-2
7.4.3+dfsg-1
7.4.4+dfsg-1
7.4.5+dfsg-1
7.4.6+dfsg-1
7.4.6+dfsg-2
7.4.7+dfsg-1
7.4.8+dfsg-1
7.4.9+dfsg-1
7.4.10+dfsg-1