CVE catalog

CVE-2021-41268

symfony affected and fixed versions

Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie. Starting with version 5.3.12, Symfony makes the password part of the signature by default. In that way, when the password changes, then the cookie is not valid anymore.

Severity: Low
Source: [NVD] · [CVE record]
EPSS: 1.32% · Oct 27, 2026

Projects and upstream resources

Related catalog projects (49)

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	symfony	`6.4.41+dfsg-0+deb13u1`	Not affected	[CVE-2021-41268]
Debiantrixie	symfony	Not reported	Not affectedDistribution reports not affected	[CVE-2021-41268]
Debiantrixie	symfony	`6.4.41+dfsg-0+deb13u1`	Not affected	[CVE-2021-41268]
Debiansid	symfony	Not reported	Not affectedDistribution reports not affected	[CVE-2021-41268]
Debiansid	symfony	`7.4.21+dfsg-2`	Not affected	[CVE-2021-41268]
Debianforky	symfony	Not reported	Not affectedDistribution reports not affected	[CVE-2021-41268]
Debianforky	symfony	`7.4.21+dfsg-1`	Not affected	[CVE-2021-41268]
Debianbookworm-security	symfony	`5.4.53+dfsg-0+deb12u1`	Not affected	[CVE-2021-41268]
Debianbookworm	symfony	Not reported	Not affectedDistribution reports not affected	[CVE-2021-41268]
Debianbookworm	symfony	`5.4.53+dfsg-0+deb12u1`	Not affected	[CVE-2021-41268]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	symfony	Not reported	Not affectedDistribution reports not affected	[CVE-2021-41268]
Debianbookworm	symfony	`5.4.53+dfsg-0+deb12u1`	Not affected	[CVE-2021-41268]
Debianbookworm-security	symfony	`5.4.53+dfsg-0+deb12u1`	Not affected	[CVE-2021-41268]
Debianforky	symfony	Not reported	Not affectedDistribution reports not affected	[CVE-2021-41268]
Debianforky	symfony	`7.4.21+dfsg-1`	Not affected	[CVE-2021-41268]
Debiansid	symfony	Not reported	Not affectedDistribution reports not affected	[CVE-2021-41268]
Debiansid	symfony	`7.4.21+dfsg-2`	Not affected	[CVE-2021-41268]
Debiantrixie	symfony	Not reported	Not affectedDistribution reports not affected	[CVE-2021-41268]
Debiantrixie	symfony	`6.4.41+dfsg-0+deb13u1`	Not affected	[CVE-2021-41268]
Debiantrixie-security	symfony	`6.4.41+dfsg-0+deb13u1`	Not affected	[CVE-2021-41268]

Original provider fields

{
  "package_releases": [
    {
      "name": "symfony",
      "status": "not affected",
      "release": "sid",
      "version": "7.4.21+dfsg-2"
    },
    {
      "name": "symfony",
      "status": "not affected",
      "release": "forky",
      "version": "7.4.21+dfsg-1"
    },
    {
      "name": "symfony",
      "status": "not affected",
      "release": "trixie",
      "version": "6.4.41+dfsg-0+deb13u1"
    },
    {
      "name": "symfony",
      "status": "not affected",
      "release": "trixie-security",
      "version": "6.4.41+dfsg-0+deb13u1"
    },
    {
      "name": "symfony",
      "status": "not affected",
      "release": "bookworm",
      "version": "5.4.53+dfsg-0+deb12u1"
    },
    {
      "name": "symfony",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "5.4.53+dfsg-0+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "symfony",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "symfony",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "symfony",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "symfony",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[php-symfony]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-all-my-sms-notifier]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-amazon-mailer]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-amazon-sns-notifier]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-amazon-sqs-messenger]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-amqp-messenger]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-asset]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-beanstalkd-messenger]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-browser-kit]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-cache]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-clickatell-notifier]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-config]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-console]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-crowdin-translation-provider]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-css-selector]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-debug-bundle]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-dependency-injection]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-discord-notifier]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-doctrine-bridge]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
[php-symfony-doctrine-messenger]Unknown
Source package: [symfony]
Details (4)
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm
- 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
  Not affected
  dsa · symfony · debian · bookworm

Next results

Observed: Oct 23, 2026, 6:02:44 PM UTC

References

[https://security-tracker.debian.org/tracker/CVE-2021-41268]

[Debian Security Tracker] · [FIRST EPSS]