[CVE-2026-109449 ] In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2026-109413 ] In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collec
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2026-108082 ] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a
High(8.7) Affected Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Affected
nvd · symfony · debian · bookworm; nvd · symfony · debian · 12
[CVE-2026-46626 ] symfony: CVE-2026-46626
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 10:02:49 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 5.4.53+dfsg-0+deb12u1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 5.4.53+dfsg-0+deb12u1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2024-51736 ] symfony: CVE-2024-51736
Low Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 24, 2026, 12:41:53 AM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Not affected
dsa · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm
Not affected
dsa · symfony · debian · bookworm
[CVE-2022-24894 ] Symfony vulnerabilities
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:24:50 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
[CVE-2022-24895 ] Symfony vulnerabilities
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:24:50 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 5.4.20+dfsg-1
usn · symfony · debian · bookworm
[CVE-2021-41270 ] symfony: CVE-2021-41270
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:02:45 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.19+dfsg-3
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.19+dfsg-3
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2021-21424 ] symfony: CVE-2021-21424
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:54:41 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.19+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.19+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-15094 ] symfony: CVE-2020-15094
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:48:12 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.13+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.13+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5275 ] symfony: CVE-2020-5275
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:52 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5274 ] symfony: CVE-2020-5274
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:52 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2020-5255 ] symfony: CVE-2020-5255
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:51 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-11325 ] symfony: CVE-2019-11325
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:42 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18888 ] symfony: CVE-2019-18888
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18889 ] symfony: CVE-2019-18889
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18886 ] symfony: CVE-2019-18886
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2019-18887 ] symfony: CVE-2019-18887
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
[CVE-2017-11365 ] symfony: CVE-2017-11365
Low Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:25:44 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Not affected
dsa · symfony · debian · bookworm
5.4.53+dfsg-0+deb12u1 · all · bookworm
Not affected
dsa · symfony · debian · bookworm
[CVE-2019-10912 ] symfony: CVE-2019-10912
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:29 PM UTC
Details (2) 5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12
5.4.53+dfsg-0+deb12u1 · all · bookworm
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · bookworm; dsa · symfony · debian · 12