Symfony · week of 26 Oct 2026
Symfony security note
Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
CVE-2026-109413 — Check if you run it
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
Seen in 2.0.0 → 5.4.54 · 3 other packages on the advisory
CVE-2026-108082 — Check if you run it
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
Seen in 4.1.0 → 5.4.54 · 3 other packages on the advisory
What we still do not know
Every changed record in this note has a version range.
Share this note
Symfony security note, week of 26 Oct 2026: 2 records have a version a customer can check, and 0 still do not. https://zerodayfindings.com/technologies/symfony/notes/2026-W44