Symfony Blog

All about Symfony releases, new Symfony features, and other important announcements

GHSA-hwfg-qwvh-2wfx Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process

Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
November 4, 2026 #Security Advisories #Symfony

GHSA-6prc-h956-hxjq Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory

Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory
November 4, 2026 #Security Advisories #Symfony

GHSA-pxj9-jh84-vhm5 DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files

DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
November 4, 2026 #Security Advisories #Symfony

GHSA-c7hm-wqwp-f9v8 NoPrivateNetworkHttpClient Does Not Pin the IP of Cached Hosts: Incomplete Fix for CVE-2024-50342

NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports: Incomplete Fix for CVE-2024-50342
November 4, 2026 #Security Advisories #Symfony

GHSA-8f57-m8wj-x65w Programmatic Logins Skip the checkPostAuth() Method of User Checkers

Programmatic Logins Skip the checkPostAuth() Method of User Checkers
November 4, 2026 #Security Advisories #Symfony

GHSA-wg5q-m2ww-f3c9 Inline Fragments Let Untrusted Forwarded Headers Change the URLs Generated for the Main Request

Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
November 4, 2026 #Security Advisories #Symfony

GHSA-gq53-v8w2-gjhj ScopingHttpClient Sends Its Default Scope Credentials to Other Origins via Network-Path References

ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
November 4, 2026 #Security Advisories #Symfony

GHSA-xg2q-4rrq-657q The "private_ranges" Trusted Proxies Shortcut Trusts IPv4-Mapped, 6to4, Teredo and NAT64 Clients

The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies
November 4, 2026 #Security Advisories #Symfony

GHSA-hqp2-7rr8-hf26 ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
November 4, 2026 #Security Advisories #Symfony

GHSA-5jff-8h8q-r5qx XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true
November 4, 2026 #Security Advisories #Symfony