-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 27 May 2026 19:56:10 +0200 Source: symfony Architecture: source Version: 6.4.41+dfsg-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: Debian PHP PEAR Maintainers <[email protected]> Changed-By: David Prévot <[email protected]> Changes: symfony (6.4.41+dfsg-0+deb13u1) trixie-security; urgency=medium . [ Fabien Potencier ] * Update VERSION for 6.4.41 . [ Nicolas Grekas ] * [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs [CVE-2026-45064] * [MonologBridge] Bind server:log to localhost by default [CVE-2026-45077] * [Yaml] Bound recursion depth in the parser [CVE-2026-45133] * [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() [CVE-2026-45072] * [Cache] Validate the prefix given to AbstractAdapter::clear() [CVE-2026-45073] * [Yaml] Bound collection-alias resolution in the parser [CVE-2026-45304] * [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking [CVE-2026-45305] * [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING'] [CVE-2026-46626] * [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient [CVE-2026-48736] * [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS [CVE-2026-48736] * [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs [CVE-2026-48760] * [HtmlSanitizer] Sanitize URL attributes on <object>, <applet>, <iframe>, <img>, and the URL inside <meta http-equiv="refresh"> content [CVE-2026-48761] * [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs [CVE-2026-48784] * [Security] Don't honor user-supplied _failure_path on failure_forward [CVE-2026-48489] . [ Alexandre Daubois ] * [Routing] Fix regex alternation anchoring in UrlGenerator requirement validation [CVE-2026-45065] * [DomCrawler] Fix XXE in addXmlContent() by not enabling `validateOnParse` [CVE-2026-45071] * [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification [CVE-2026-45066] * [Security] Add missing claims in `OidcTokenHandler` [CVE-2026-45069] * [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator [CVE-2026-45063] * [Mime] Reject email addresses containing line breaks in Address [CVE-2026-45067] * [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash [CVE-2026-45068] * [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials [CVE-2026-45754] Checksums-Sha1: 134554c1dfcb68d673eb89a0c0537e53d75621c1 16771 symfony_6.4.41+dfsg-0+deb13u1.dsc 27c32d81117e02a728dbca200ae01d5375fd9a30 8773824 symfony_6.4.41+dfsg.orig.tar.xz 4bad294031b5650e584bdf444c4a01c2623a9ea5 79176 symfony_6.4.41+dfsg-0+deb13u1.debian.tar.xz 1cd8beb61840d7c90878f938a985b2d2f83a457a 71613 symfony_6.4.41+dfsg-0+deb13u1_i386.buildinfo Checksums-Sha256: 6d9136ed0a864da685f1938f1562d1113e7b1a425c35c81bece32ddd174d13fe 16771 symfony_6.4.41+dfsg-0+deb13u1.dsc cb5a93b47cbfea37894e6907bdcf2e75373ca10fc377c85a58c4aeaae11d6083 8773824 symfony_6.4.41+dfsg.orig.tar.xz b269532472c5881ce090cb6193a5f63cea725e92d2633c953a45f07afbab6212 79176 symfony_6.4.41+dfsg-0+deb13u1.debian.tar.xz 60bef30803cc851011e0b850dbdad010efd4eb5267c6010ef77a464ab226cfec 71613 symfony_6.4.41+dfsg-0+deb13u1_i386.buildinfo Files: 8f3aad631aea8d8803b6af366d5a3805 16771 php optional symfony_6.4.41+dfsg-0+deb13u1.dsc a50992625fa71b57d933f95a5ef79d56 8773824 php optional symfony_6.4.41+dfsg.orig.tar.xz 0b14214dd0ca1935544e16531e0e1b0e 79176 php optional symfony_6.4.41+dfsg-0+deb13u1.debian.tar.xz 58f67dfdbf1b1550b6ae735bd8fc428c 71613 php optional symfony_6.4.41+dfsg-0+deb13u1_i386.buildinfo
-----BEGIN PGP SIGNATURE----- iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmoYs/ISHHRhZmZpdEBk ZWJpYW4ub3JnAAoJEAWMHPlE9r08i3oH/1eNy40d5+dnfiRE+A4skxM+pMqI9omb q2awpyGawxQPULTNEEjwyp7ru4fdyN2K2DsqDCUpGA1ZwCT7/cqWQYDQRGMZNntP qOzDCF+d2KYhSREeSZ0NlP4DFXyA+kmv2LTDIa3yXyIXVMfhOXaU7RzfTO2KmNmo kSpfTWS6hCwQh5JWbge44FamIC+PLWrxAx2QXaJJcDXwCK90a1NRz2GFdA60aSKn 83n81uZbj0xjdVAkQrHIM8t6+7sa6LhSjoru2XmQYLb6Z1XLsKqfaM2VRLyXUCKR TtTLCnKUoTUlX93Dky+igMMduALiAQgSPC8b+/ZwVyqtacEIJwQizPE= =DNRF -----END PGP SIGNATURE-----
pgpo7s8tJRci4.pgp
Description: PGP signature
