Have found a security issue in Symfony? Send the details to
security [at] symfony.com and don't
disclose it publicly until we can provide a fix for it.
Manage your notification preferences to receive an email as soon as a Symfony security release is published.
X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063
November 4, 2026
#Security Advisories
👍 1
Yesterday, we released Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10. Their changelogs list security fixes that were announced before, which confused some of you. Here is what these releases change, and what you should do.
October 29, 2026
#Security Advisories
👍 2
Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
October 15, 2026
#Security Advisories
Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
October 15, 2026
#Security Advisories
ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
October 15, 2026
#Security Advisories
Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
June 19, 2026
#Security Advisories
XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
June 19, 2026
#Security Advisories
XSS in symfony/ux-autocomplete via unescaped AJAX response data
May 29, 2026
#Security Advisories
CVE-2026-49215 CSRF Protection Bypass in symfony/ux-live-component: Accept Header is CORS-Safelisted
CSRF Protection Bypass in symfony/ux-live-component: Accept Header is CORS-Safelisted
May 29, 2026
#Security Advisories
LiveComponentHydrator HMAC checksum lacks component and slot binding
May 29, 2026
#Security Advisories
👍 1