« Symfony » blog posts

CVE-2026-47212 Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection

Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
May 20, 2026 #Symfony

CVE-2026-46626 SymfonyRuntime CVE-2024-50340 Patch Bypass via parse_str/SAPI Argv Mismatch

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
May 20, 2026 #Symfony

CVE-2026-45756 JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS

JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
May 20, 2026 #Symfony

CVE-2026-45755 Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection

Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection
May 20, 2026 #Symfony

CVE-2026-45754 Mailjet and LOX24 Webhook Parsers Never Verify the Configured Secret: Unauthenticated Event Injection

Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection
May 20, 2026 #Symfony

CVE-2026-45753 HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite: javascript: URI Survives Sanitization (XSS)

HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite: javascript: URI Survives Sanitization (XSS)
May 20, 2026 #Symfony

CVE-2026-45305 YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
May 20, 2026 #Symfony

CVE-2026-45304 YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
May 20, 2026 #Symfony

CVE-2026-45133 YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings

YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
May 20, 2026 #Symfony

CVE-2026-45077 Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
May 20, 2026 #Symfony