Symfony: Multiple Component Vulnerabilities (CVE-2026-118516)
Multiple vulnerabilities across Symfony components, including filesystem, http-client, and security-http, allow for remote denial of service, data confidentiality compromise, and security policy bypass.
CVE search metadata
CVE search record: CVE-2026-118516. KEV: no. Product: filesystem (< 5.4.56, 6.4.50, 7.4.23, 8.1.11), http-client (< 5.4.56, 6.4.50, 7.4.23, 8.1.11), http-foundation (< 5.4.56, 6.4.50, 7.4.23, 8.1.11), json-path (7.3.0 to 7.4.x < 7.4.23, 8.x < 8.1.11), routing (< 5.4.56, 6.4.50, 7.4.23, 8.1.11), security-http (< 5.4.56, 6.4.50, 7.4.23, 8.1.11), serializer (< 5.4.56, 6.4.50, 7.4.23, 8.1.11), symfony (< 5.4.56, 6.4.50, 7.4.23, 8.1.11), yaml (< 5.4.56, 6.4.50, 7.4.23, 8.1.11). Brief: Symfony: Multiple Component Vulnerabilities (CVE-2026-118516). Brief link: https://feed.craftedsignal.io/briefs/2026-11-symfony-vulnerabilities/
Triage facts
Revision 1- Applicability
- filesystem (< 5.4.56, 6.4.50, 7.4.23, 8.1.11), http-client (< 5.4.56, 6.4.50, 7.4.23, 8.1.11) +7
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 11 public sources
- Freshness
- Revision 1Nov 4, 16:20 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The French CERT (ANSSI) has reported multiple vulnerabilities affecting several core components of the Symfony PHP framework. These vulnerabilities impact various versions of the filesystem, http-client, http-foundation, json-path, routing, security-http, serializer, and yaml components. The reported risks include remote denial of service, unauthorized access to sensitive data, and bypass of configured security policies. Users should refer to the individual GitHub Security Advisories linked below to determine the specific impact on their environment and apply the necessary patches.
Impact
Successful exploitation may result in remote denial of service, compromise of data confidentiality, or security policy bypass, depending on the specific component and configuration involved.
Recommendation
- Identify all instances of the Symfony framework and its components within the organization's infrastructure.
- Update all affected Symfony components to the versions specified as fixed in the security advisories (e.g., 5.4.56, 6.4.50, 7.4.23, or 8.1.11, depending on the release branch).
- Review the GitHub security advisories for each affected component (referenced below) to assess specific technical impact and remediation requirements.
Mitigations
Upgrade affected Symfony components to the specified secure versions (e.g., 5.4.56, 6.4.50, 7.4.23, or 8.1.11)
CVE-2026-118516