[CVE-2026-109449 ] In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of
High(8.7) Affected Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Affected
nvd · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Affected
nvd · symfony · debian · 13
[CVE-2026-109413 ] In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collec
High(8.7) Affected Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Affected
nvd · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Affected
nvd · symfony · debian · 13
[CVE-2026-108082 ] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a
High(8.7) Affected Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Affected
nvd · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Affected
nvd · symfony · debian · 13
[CVE-2026-46626 ] symfony: CVE-2026-46626
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 10:02:49 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1
dsa · symfony · debian · 13
[CVE-2021-41270 ] symfony: CVE-2021-41270
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:02:45 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.19+dfsg-3
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.19+dfsg-3
dsa · symfony · debian · 13
[CVE-2021-21424 ] symfony: CVE-2021-21424
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:54:41 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.19+dfsg-2
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.19+dfsg-2
dsa · symfony · debian · 13
[CVE-2020-15094 ] symfony: CVE-2020-15094
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:48:12 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.13+dfsg-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.13+dfsg-1
dsa · symfony · debian · 13
[CVE-2020-5275 ] symfony: CVE-2020-5275
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:52 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · 13
[CVE-2020-5274 ] symfony: CVE-2020-5274
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:52 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · 13
[CVE-2020-5255 ] symfony: CVE-2020-5255
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:52:51 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.4.8-1
dsa · symfony · debian · 13
[CVE-2019-11325 ] symfony: CVE-2019-11325
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:42 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
[CVE-2019-18888 ] symfony: CVE-2019-18888
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
[CVE-2019-18889 ] symfony: CVE-2019-18889
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
[CVE-2019-18886 ] symfony: CVE-2019-18886
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
[CVE-2019-18887 ] symfony: CVE-2019-18887
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:42:13 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 4.3.8+dfsg-1
dsa · symfony · debian · 13
[CVE-2019-10912 ] symfony: CVE-2019-10912
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:29 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
[CVE-2019-10913 ] symfony: CVE-2019-10913
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:29 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
[CVE-2019-10909 ] symfony: CVE-2019-10909
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:29 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
[CVE-2019-10910 ] symfony: CVE-2019-10910
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:28 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
[CVE-2019-10911 ] symfony: CVE-2019-10911
Medium Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:38:29 PM UTC
Details (2) 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13
6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 3.4.22+dfsg-2
dsa · symfony · debian · 13