[CVE-2026-109449 ] Published: Oct 15, 2026, 3:19:08 PM UTC
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2026-109413 ] Published: Oct 15, 2026, 2:57:00 PM UTC
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collec
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2026-108082 ] Published: Oct 15, 2026, 2:46:01 PM UTC
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2024-51736 ] Published: Feb 17, 2026, 11:00:00 PM UTC
symfony: CVE-2024-51736
Low Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 24, 2026, 1:43:05 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Not affected
dsa · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Not affected
dsa · symfony · debian · bookworm
[CVE-2025-64500 ] Published: Nov 12, 2025, 10:15:50 PM UTC
symfony: CVE-2025-64500
High(7.3) Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 24, 2026, 4:36:25 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.23+dfsg-1+deb12u5
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.23+dfsg-1+deb12u5
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2022-24894 ] Published: Feb 3, 2023, 10:15:00 PM UTC
Symfony vulnerabilities
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:24:50 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
[CVE-2022-24895 ] Published: Feb 3, 2023, 10:15:00 PM UTC
Symfony vulnerabilities
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:24:50 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
[CVE-2021-41270 ] Published: Nov 24, 2021, 7:15:00 PM UTC
symfony: CVE-2021-41270
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:02:45 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.19+dfsg-3
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.19+dfsg-3
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2021-21424 ] Published: May 13, 2021, 4:15:00 PM UTC
symfony: CVE-2021-21424
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:54:41 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.19+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.19+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-15094 ] Published: Sep 2, 2020, 6:15:11 PM UTC
symfony: CVE-2020-15094
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:48:12 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.13+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.13+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5275 ] Published: Mar 30, 2020, 8:15:19 PM UTC
symfony: CVE-2020-5275
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:52 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5274 ] Published: Mar 30, 2020, 8:15:19 PM UTC
symfony: CVE-2020-5274
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:52 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5255 ] Published: Mar 30, 2020, 8:15:19 PM UTC
symfony: CVE-2020-5255
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:51 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-11325 ] Published: Nov 21, 2019, 11:15:00 PM UTC
symfony: CVE-2019-11325
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:42 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18888 ] Published: Nov 21, 2019, 11:15:00 PM UTC
symfony: CVE-2019-18888
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18889 ] Published: Nov 21, 2019, 11:15:00 PM UTC
symfony: CVE-2019-18889
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18886 ] Published: Nov 18, 2019, 12:00:00 AM UTC
symfony: CVE-2019-18886
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18887 ] Published: Nov 18, 2019, 12:00:00 AM UTC
symfony: CVE-2019-18887
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2017-11365 ] Published: May 23, 2019, 6:29:00 PM UTC
symfony: CVE-2017-11365
Low Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:25:44 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Not affected
dsa · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Not affected
dsa · symfony · debian · bookworm
[CVE-2019-10912 ] Published: May 16, 2019, 10:29:00 PM UTC
symfony: CVE-2019-10912
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:29 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm-security
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12