Symfony storing cookie headers in HttpCache

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Symfony Vulnerable to Timing Attack

Symfony Session Fixation Vulnerability

Firewall configured with unanimous strategy was not actually unanimous in Symfony

Symfony CSRF Token Fixation

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Symfony Denial of Service Via Long Password Hashing

Symfony SSRF Vulnerability via Form Component

Symfony Directory Traversal

Symfony hardened the parser when handling untrusted input

Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Symfony CSRF Vulnerability

Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS

Symfony Open Redirect

Symfony Access Control Vulnerability

Symfony Allows URI Restrictions Bypass Via Double-Encoded String

Symfony Arbitrary PHP code Execution