{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/routing--5.4.56-6.4.50-7.4.23-8.1.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-118516"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["filesystem (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)","http-client (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)","http-foundation (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)","json-path (7.3.0 to 7.4.x \u003c 7.4.23, 8.x \u003c 8.1.11)","routing (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)","security-http (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)","serializer (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)","symfony (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)","yaml (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","php","web-framework"],"_cs_type":"advisory","_cs_vendors":["Symfony"],"content_html":"\u003cp\u003eThe French CERT (ANSSI) has reported multiple vulnerabilities affecting several core components of the Symfony PHP framework. These vulnerabilities impact various versions of the filesystem, http-client, http-foundation, json-path, routing, security-http, serializer, and yaml components. The reported risks include remote denial of service, unauthorized access to sensitive data, and bypass of configured security policies. Users should refer to the individual GitHub Security Advisories linked below to determine the specific impact on their environment and apply the necessary patches.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in remote denial of service, compromise of data confidentiality, or security policy bypass, depending on the specific component and configuration involved.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of the Symfony framework and its components within the organization's infrastructure.\u003c/li\u003e\n\u003cli\u003eUpdate all affected Symfony components to the versions specified as fixed in the security advisories (e.g., 5.4.56, 6.4.50, 7.4.23, or 8.1.11, depending on the release branch).\u003c/li\u003e\n\u003cli\u003eReview the GitHub security advisories for each affected component (referenced below) to assess specific technical impact and remediation requirements.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T16:20:52Z","date_published":"2026-11-04T16:20:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-symfony-vulnerabilities/","summary":"Multiple vulnerabilities across Symfony components, including filesystem, http-client, and security-http, allow for remote denial of service, data confidentiality compromise, and security policy bypass.","title":"Symfony: Multiple Component Vulnerabilities (CVE-2026-118516)","url":"https://feed.craftedsignal.io/briefs/2026-11-symfony-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Routing (\u003c 5.4.56, 6.4.50, 7.4.23, 8.1.11)","version":"https://jsonfeed.org/version/1.1"}