All CVEs shipped in the coordinated release of v5.4.x / v6.4.40 / v7.4.12 / v8.0.12 on May 20, 2026. CVE numbers and descriptions are sourced from the v8.0.12 release notes. SA links are sourced from the Symfony security advisories blog.
| CVE | Component | Impact | SA report | Fix commit | Branches |
|---|---|---|---|---|---|
| CVE-2026-46626 | [Runtime] | CVE-2024-50340 patch bypass: web requests can still set APP_ENV/APP_DEBUG via parse_str/SAPI argv mismatch |
SA | 3228c3806e | 5.4+ |
| CVE-2026-47212 | [Notifier/Twilio] | Twilio webhook parser never verifies the X-Twilio-Signature HMAC: unauthenticated webhook event injection | SA | 8545fb2af6 | 5.4+ |
| CVE-2026-45754 | [Notifier/Lox24] | Mailjet and LOX24 webhook parsers never verify the configured secret: unauthenticated event injection | SA | 6efcde1b6b | 5.4+ |
| CVE-2026-45754 | [Mailer/Mailjet] | Mailjet and LOX24 webhook parsers never verify the configured secret: unauthenticated event injection | SA | 3e52bf5ab7 | 6.4+ |
| CVE-2026-45753 | [HtmlSanitizer] | UrlAttributeSanitizer omits action/formaction/poster/cite: javascript: URI survives sanitization (XSS) |
SA | 487728e7e1 | 5.4+ |
| CVE-2026-45063 | [Security/X509] | Identity spoofing via unanchored DN regex in X509Authenticator | SA | c609fbeb82 | 5.4+ |
| CVE-2026-45064 | [HtmlSanitizer] | URL attributes pass through BiDi override characters, enabling visual href spoofing | SA | 2b1b3cc889 | 5.4+ |
| CVE-2026-45065 | [Routing] | UrlGenerator route-requirement bypass via unanchored regex alternation, enabling off-site //host URL injection |
SA | e759214d50 | 5.4+ |
| CVE-2026-45066 | [HtmlSanitizer] | allowLinkHosts()/allowMediaHosts() bypass via URL-parser differentials and <area> misclassification |
SA | 6fccb4c1f5 | 5.4+ |
| CVE-2026-45067 | [Mime] | Email header / SMTP command injection via CRLF in Mime\Address |
SA | 693aeaeb24 | 5.4+ |
| CVE-2026-45068 | [Mailer/Sendmail] | Argument injection in SendmailTransport via dash-prefixed recipient address |
SA | d7e275130f | 5.4+ |
| CVE-2026-45069 | [Security/OIDC] | OidcTokenHandler accepts JWTs missing aud/iss/exp claims |
SA | 802601c719 | 5.4+ |
| CVE-2026-45071 | [DomCrawler] | XXE (local file disclosure) in addXmlContent() via validateOnParse = true |
SA | d23d7eca9d | 5.4+ |
| CVE-2026-45072 | [TwigBridge] | Stored XSS in WebProfiler CodeExtension::fileExcerpt() via unescaped non-PHP file rendering |
SA | d790642253 | 5.4+ |
| CVE-2026-45073 | [Cache] | SQL injection in PdoAdapter::doClear() via unsanitized $prefix |
SA | ec50b799d7 | 5.4+ |
| CVE-2026-45074 | [Security/CAS] | Cas2Handler derives CAS service URL from client Host header, enabling cross-service ticket replay |
SA | 5ba145dba7 | 7.4+ |
| CVE-2026-45075 | [Security/HttpKernel] | HEAD request bypasses methods: ['GET'] filter in #[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid] |
SA | 694b642f23 | 7.4+ |
| CVE-2026-45077 | [MonologBridge] | Unauthenticated PHP object deserialization in server:log listener (binds to all interfaces) |
SA | c58c0f7086 | 5.4+ |
| CVE-2026-45133 | [Yaml] | Stack exhaustion via unbounded recursion in nested blocks, sequences, and mappings | SA | 4f1a08e951 | 5.4+ |
| CVE-2026-45304 | [Yaml] | Exponential memory allocation via recursive collection-alias expansion ("Billion Laughs") | SA | e77391b2e4 | 5.4+ |
| CVE-2026-45305 | [Yaml] | YAML parser ReDoS via catastrophic backtracking in Parser::cleanup() regex |
SA | 9749cd43c5 | 5.4+ |
| CVE-2026-45755 | [Mailer/Mailtrap] | Mailtrap webhook parser never verifies the X-Mt-Signature HMAC: unauthenticated webhook event injection | SA | 4e0467e4e1 | 6.4+ |
| CVE-2026-45756 | [JsonPath] | JsonPath evaluates attacker-controlled regular expressions in match()/search() without limits: ReDoS |
SA | 1ac2d47418 | 7.4+ |