Multiple Denial of Service Vulnerabilities in Symfony Framework

Multiple vulnerabilities have been identified within the Symfony framework, specifically affecting the expression-language, http-foundation, and yaml components, as well as the core symfony/symfony package. These flaws impact various versions across the 5.4.x, 6.4.x, 7.4.x, and 8.1.x branches. The vulnerabilities are identified as CVE-2026-108082, CVE-2026-109413, and CVE-2026-109449. Successful exploitation of these vulnerabilities allows a remote attacker to induce a denial-of-service (DoS) condition on applications utilizing the vulnerable components, potentially rendering the service unavailable to legitimate users. Organizations running these versions of Symfony should prioritize updating to the patched versions provided by the vendor.

Impact

The primary impact of these vulnerabilities is the disruption of service availability. Attackers can remotely trigger resource exhaustion or application crashes in systems relying on affected Symfony components. Given the prevalence of Symfony in modern PHP web development, any internet-facing application running unpatched versions is susceptible to DoS attacks.

Recommendation

• Upgrade symfony/expression-language to 5.4.54, 6.4.48, 7.4.21, or 8.1.9 or later.
• Upgrade symfony/http-foundation to 5.4.54, 6.4.46, 7.4.19, or 8.1.7 or later.
• Upgrade symfony/symfony to 5.4.54, 6.4.48, 7.4.21, or 8.1.9 or later.
• Upgrade symfony/yaml to 5.4.54, 6.4.45, 7.4.18, or 8.1.6 or later.
• Review the specific GitHub Security Advisories linked in the Documentation section of the CERT-FR report to understand the specific triggers for the DoS conditions in your environment.