---
title: "symfony symfony/symfony vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/symfony/symfony-symfony
type: product
description: "symfony symfony/symfony has 90 published CVEs, 0 in CISA KEV and 3 with public exploits."
updated: 2026-10-15
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# symfony symfony/symfony vulnerabilities

Vendor: [symfony](https://radicalnotion.ai/vendor/symfony)

- **Published CVEs:** 90
- **In CISA KEV:** 0
- **With a public exploit:** 3
- **With a patch:** 90
- **Average CVSS:** 6.9
- **First CVE:** 2012-12-27
- **Latest CVE:** 2026-10-15
- **Ecosystems:** composer

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 8 |
| High | 37 |
| Medium | 37 |
| Low | 8 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 8 |
| [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 6 |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 4 |
| [CWE-384](https://radicalnotion.ai/cwe/cwe-384) | Session Fixation | 4 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 4 |
| [CWE-88](https://radicalnotion.ai/cwe/cwe-88) | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | 3 |
| [CWE-601](https://radicalnotion.ai/cwe/cwe-601) | URL Redirection to Untrusted Site ('Open Redirect') | 3 |
| [CWE-1333](https://radicalnotion.ai/cwe/cwe-1333) | Inefficient Regular Expression Complexity | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2015 | 4 |
| 2016 | 2 |
| 2017 | 1 |
| 2018 | 13 |
| 2019 | 12 |
| 2020 | 5 |
| 2021 | 5 |
| 2022 | 0 |
| 2023 | 5 |
| 2024 | 5 |
| 2025 | 1 |
| 2026 | 32 |

## Affected versions (top 24 of 286)

| Version | Kind | CVEs |
| --- | --- | --- |
| 8.0.0 \<= v \< 8.0.12 | range | 22 |
| 7.0.0 \<= v \< 7.4.12 | range | 15 |
| \< 5.4.52 | range | 11 |
| 6.0.0 \<= v \< 6.4.40 | range | 10 |
| 8.0.0 \<= v \< 8.0.13 | range | 6 |
| 2.0.0 \<= v \< 2.3.19 | range | 5 |
| 2.4.0 \<= v \< 2.4.9 | range | 5 |
| 2.5.0 \<= v \< 2.5.4 | range | 5 |
| 2.8.0 \<= v \< 2.8.50 | range | 5 |
| 3.0.0 \<= v \< 3.4.26 | range | 5 |
| 4.0.0 \<= v \< 4.1.12 | range | 5 |
| 4.2.0 \<= v \< 4.2.7 | range | 5 |
| 7.4.12 | patched | 23 |
| 8.0.12 | patched | 23 |
| 6.4.40 | patched | 19 |
| 5.4.52 | patched | 12 |
| 7.4.13 | patched | 6 |
| 8.0.13 | patched | 6 |
| 2.3.19 | patched | 5 |
| 2.4.9 | patched | 5 |
| 2.5.4 | patched | 5 |
| 2.8.50 | patched | 5 |
| 3.3.17 | patched | 5 |
| 3.4.26 | patched | 5 |

## CVEs (first 30 of 90, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-109413 | Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process | high | 8.7 | No | No | Yes |
| CVE-2026-108082 | Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | high | 8.7 | No | No | Yes |
| CVE-2026-48761 | Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on , , , and the URL Inside content | medium | 5.3 | No | No | Yes |
| CVE-2026-48747 | Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade | medium | 6.3 | No | No | Yes |
| CVE-2026-48489 | Symfony: Security Firewall Bypass via failure\_forward Subrequest: Unauthenticated Access to access\_control-Protected GET Routes | high | 8.7 | No | No | Yes |
| CVE-2026-48760 | Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense | medium | 5.3 | No | No | Yes |
| CVE-2026-48736 | Symfony: IpUtils::PRIVATE\_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient | medium | 6.9 | No | No | Yes |
| CVE-2026-48784 | Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained \`../\` or \`./\` → Generated URL Collapses Off-Route Under RFC 3986 Normalization | medium | 6.9 | No | No | Yes |
| CVE-2026-45068 | Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address | high | 8.7 | No | No | Yes |
| CVE-2026-47212 | Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection | medium | 6.9 | No | No | Yes |
| CVE-2026-45071 | Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true | high | 8.7 | No | No | Yes |
| CVE-2026-45755 | Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection | medium | 6.9 | No | No | Yes |
| CVE-2026-45754 | Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection | medium | 6.9 | No | No | Yes |
| CVE-2026-45305 | Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex | high | 8.7 | No | No | Yes |
| CVE-2026-45304 | Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") | high | 8.7 | No | No | Yes |
| CVE-2026-45069 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | high | 8.8 | No | No | Yes |
| CVE-2026-45133 | Symfony: \[Yaml\] Harden the parser when handling untrusted input | high | 8.2 | No | No | Yes |
| CVE-2026-45075 | Symfony: HEAD Request Bypasses methods: \['GET'\] Filter in #\[IsGranted\] / #\[IsSignatureValid\] / #\[IsCsrfTokenValid\] | high | 8.6 | No | No | Yes |
| CVE-2026-47767 | Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP\_ENV/APP\_DEBUG via parse\_str/SAPI Argv Mismatch | high | 8.3 | No | No | Yes |
| CVE-2026-45064 | Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing | medium | 6.9 | No | No | Yes |
| CVE-2026-45063 | Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator | critical | 9.1 | No | No | Yes |
| CVE-2026-45070 | Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names | medium | 6.3 | No | No | Yes |
| CVE-2026-45073 | Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix | medium | 6.3 | No | No | Yes |
| CVE-2026-45753 | Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) | low | 2.1 | No | No | Yes |
| CVE-2026-45072 | Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering | low | 2.0 | No | No | Yes |
| CVE-2026-45756 | Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS | high | 8.2 | No | No | Yes |
| CVE-2026-45066 | Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and Misclassification | low | 2.3 | No | No | Yes |
| CVE-2026-45074 | Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay | high | 7.6 | No | No | Yes |
| CVE-2026-45077 | Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener | high | 8.3 | No | No | Yes |
| CVE-2026-45065 | Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection | low | 2.3 | No | No | Yes |

## Frequently asked questions

### How many CVEs does symfony symfony/symfony have?

symfony symfony/symfony has 90 published CVE records since 2012.

### How many symfony symfony/symfony CVEs are in CISA KEV?

None of symfony symfony/symfony's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for symfony symfony/symfony vulnerabilities?

Yes — 3 of symfony symfony/symfony's CVEs have a known public exploit.

### Which versions of symfony symfony/symfony are affected?

286 distinct symfony symfony/symfony versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in symfony symfony/symfony CVEs?

symfony symfony/symfony's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-287 (Improper Authentication), CWE-20 (Improper Input Validation), CWE-384 (Session Fixation).

### How many critical symfony symfony/symfony vulnerabilities are there?

symfony symfony/symfony has 8 critical and 37 high-severity CVEs.

### What is the average severity of symfony symfony/symfony CVEs?

The average CVSS base score across symfony symfony/symfony's scored CVEs is 6.9.

## Other products from this vendor

- [symfony](https://radicalnotion.ai/vendor/symfony/symfony) (115 CVEs)
- [twig](https://radicalnotion.ai/vendor/symfony/twig) (25 CVEs)
- [symfony/security-http](https://radicalnotion.ai/vendor/symfony/symfony-security-http) (19 CVEs)
- [symfony/security](https://radicalnotion.ai/vendor/symfony/symfony-security) (17 CVEs)
- [symfony/http-foundation](https://radicalnotion.ai/vendor/symfony/symfony-http-foundation) (14 CVEs)
- [security-http](https://radicalnotion.ai/vendor/symfony/security-http) (11 CVEs)
- [ux](https://radicalnotion.ai/vendor/symfony/ux) (10 CVEs)
- [symfony/http-kernel](https://radicalnotion.ai/vendor/symfony/symfony-http-kernel) (8 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/symfony/symfony-symfony). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.