[CVE-2026-109449 ] In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2026-109413 ] In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collec
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2026-108082 ] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2026-46626 ] symfony: CVE-2026-46626
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 10:02:49 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.53+dfsg-0+deb12u1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.53+dfsg-0+deb12u1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2024-51736 ] symfony: CVE-2024-51736
Low Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 24, 2026, 12:41:53 AM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Not affected
dsa · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Not affected
dsa · symfony · debian · bookworm
[CVE-2022-24894 ] Symfony vulnerabilities
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:24:50 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
[CVE-2022-24895 ] Symfony vulnerabilities
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:24:50 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
[CVE-2021-41270 ] symfony: CVE-2021-41270
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:02:45 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.19+dfsg-3
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.19+dfsg-3
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2021-21424 ] symfony: CVE-2021-21424
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:54:41 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.19+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.19+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-15094 ] symfony: CVE-2020-15094
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:48:12 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.13+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.13+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5275 ] symfony: CVE-2020-5275
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:52 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5274 ] symfony: CVE-2020-5274
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:52 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5255 ] symfony: CVE-2020-5255
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:51 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-11325 ] symfony: CVE-2019-11325
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:42 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18888 ] symfony: CVE-2019-18888
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18889 ] symfony: CVE-2019-18889
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18886 ] symfony: CVE-2019-18886
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18887 ] symfony: CVE-2019-18887
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2017-11365 ] symfony: CVE-2017-11365
Low Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:25:44 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Not affected
dsa · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Not affected
dsa · symfony · debian · bookworm
[CVE-2019-10912 ] symfony: CVE-2019-10912
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:29 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12