{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/http-foundation--5.4.54-6.x--6.4.46-7.x--7.4.19-8.x--8.1.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-108082"},{"id":"CVE-2026-109413"},{"id":"CVE-2026-109449"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["expression-language (\u003c 5.4.54, 6.x \u003c 6.4.48, 7.x \u003c 7.4.21, 8.x \u003c 8.1.9)","http-foundation (\u003c 5.4.54, 6.x \u003c 6.4.46, 7.x \u003c 7.4.19, 8.x \u003c 8.1.7)","symfony (\u003c 5.4.54, 6.x \u003c 6.4.48, 7.x \u003c 7.4.21, 8.x \u003c 8.1.9)","yaml (\u003c 5.4.54, 6.x \u003c 6.4.45, 7.x \u003c 7.4.18, 8.x \u003c 8.1.6)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","web-application","symfony"],"_cs_type":"advisory","_cs_vendors":["Symfony"],"content_html":"\u003cp\u003eMultiple vulnerabilities have been identified within the Symfony framework, specifically affecting the \u003ccode\u003eexpression-language\u003c/code\u003e, \u003ccode\u003ehttp-foundation\u003c/code\u003e, and \u003ccode\u003eyaml\u003c/code\u003e components, as well as the core \u003ccode\u003esymfony/symfony\u003c/code\u003e package. These flaws impact various versions across the 5.4.x, 6.4.x, 7.4.x, and 8.1.x branches. The vulnerabilities are identified as CVE-2026-108082, CVE-2026-109413, and CVE-2026-109449. Successful exploitation of these vulnerabilities allows a remote attacker to induce a denial-of-service (DoS) condition on applications utilizing the vulnerable components, potentially rendering the service unavailable to legitimate users. Organizations running these versions of Symfony should prioritize updating to the patched versions provided by the vendor.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of these vulnerabilities is the disruption of service availability. Attackers can remotely trigger resource exhaustion or application crashes in systems relying on affected Symfony components. Given the prevalence of Symfony in modern PHP web development, any internet-facing application running unpatched versions is susceptible to DoS attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003esymfony/expression-language\u003c/code\u003e to 5.4.54, 6.4.48, 7.4.21, or 8.1.9 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003esymfony/http-foundation\u003c/code\u003e to 5.4.54, 6.4.46, 7.4.19, or 8.1.7 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003esymfony/symfony\u003c/code\u003e to 5.4.54, 6.4.48, 7.4.21, or 8.1.9 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003esymfony/yaml\u003c/code\u003e to 5.4.54, 6.4.45, 7.4.18, or 8.1.6 or later.\u003c/li\u003e\n\u003cli\u003eReview the specific GitHub Security Advisories linked in the Documentation section of the CERT-FR report to understand the specific triggers for the DoS conditions in your environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T16:26:06Z","date_published":"2026-10-15T16:26:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-symfony-dos/","summary":"Multiple vulnerabilities across Symfony components, including expression-language, http-foundation, and yaml, enable remote attackers to cause a denial-of-service condition.","title":"Multiple Denial of Service Vulnerabilities in Symfony Framework","url":"https://feed.craftedsignal.io/briefs/2026-10-symfony-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Http-Foundation (\u003c 5.4.54, 6.x \u003c 6.4.46, 7.x \u003c 7.4.19, 8.x \u003c 8.1.7)","version":"https://jsonfeed.org/version/1.1"}