« Symfony » blog posts

GHSA-5mx8-mwrp-5693 Generated URLs Can Point to a Host Chosen by the Client

Generated URLs Can Point to a Host Chosen by the Client
November 4, 2026 #Symfony

GHSA-3h27-hjv7-fqjx Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name

Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name
November 4, 2026 #Symfony

GHSA-cpww-5vpx-72x7 Incomplete Fix for CVE-2026-45756: JsonPath search(), match() and Chained Filters Can Hold a Process

Incomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters
November 4, 2026 #Symfony

GHSA-hwfg-qwvh-2wfx Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process

Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
November 4, 2026 #Symfony

GHSA-6prc-h956-hxjq Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory

Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory
November 4, 2026 #Symfony

GHSA-pxj9-jh84-vhm5 DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files

DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
November 4, 2026 #Symfony

GHSA-c7hm-wqwp-f9v8 NoPrivateNetworkHttpClient Does Not Pin the IP of Cached Hosts: Incomplete Fix for CVE-2024-50342

NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports: Incomplete Fix for CVE-2024-50342
November 4, 2026 #Symfony

GHSA-8f57-m8wj-x65w Programmatic Logins Skip the checkPostAuth() Method of User Checkers

Programmatic Logins Skip the checkPostAuth() Method of User Checkers
November 4, 2026 #Symfony

GHSA-wg5q-m2ww-f3c9 Inline Fragments Let Untrusted Forwarded Headers Change the URLs Generated for the Main Request

Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
November 4, 2026 #Symfony

GHSA-gq53-v8w2-gjhj ScopingHttpClient Sends Its Default Scope Credentials to Other Origins via Network-Path References

ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
November 4, 2026 #Symfony