[Git][security-tracker-team/security-tracker][master] Add symfony issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6a86b900 by Salvatore Bonaccorso at 2026-10-17T15:04:59+02:00
Add symfony issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1945,9 +1945,17 @@ CVE-2026-109686 (Deserialization of Untrusted Data vulnerability in Link Whisper
 CVE-2026-109685 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-109449 (InSymfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21 ...)
-	TODO: check
+	- symfony 7.4.21+dfsg-1
+	NOTE: https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rr
+	NOTE: https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process
+	NOTE: https://github.com/symfony/symfony/pull/65690
+	NOTE: https://github.com/symfony/symfony/pull/66720
+	NOTE: https://github.com/symfony/symfony/pull/66723
 CVE-2026-109413 (In Symfony YAML prior to versions5.4.54,6.4.45,7.4.18, and8.1.6,Yaml\P ...)
-	TODO: check
+	- symfony 7.4.18+dfsg-1
+	NOTE: https://github.com/symfony/symfony/security/advisories/GHSA-2v3c-qxhr-7vpv
+	NOTE: https://symfony.com/blog/cve-2026-109413-unbounded-recursion-in-the-yaml-inline-lexer-lets-a-single-document-crash-the-process
+	NOTE: https://github.com/symfony/symfony/pull/65688
 CVE-2026-109383 (undici is an HTTP client library for Node.js. In versions 4.0.0 throug ...)
 	- node-undici 8.12.2+dfsg+~cs3.2.3-1
 	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx
@@ -1970,7 +1978,11 @@ CVE-2026-108116 (In Progress Kendo UI for jQuery prior to v2026.3.1015, speciall
 CVE-2026-108092 (The Blog2Social \u2013 Social Media Auto Post & Scheduler plugin for W ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-108082 (Symfony is a PHP framework for web and console applications and a set  ...)
-	TODO: check
+	- symfony 7.4.19+dfsg-1
+	NOTE: https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc
+	NOTE: https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header
+	NOTE: https://github.com/symfony/symfony/pull/66048
+	NOTE: https://github.com/symfony/symfony/pull/66491
 CVE-2026-107416 (Authorization Bypass Through User-Controlled Key vulnerability in Webb ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-106707 (XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS)  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6a86b900b7ca84e5d51cf0fbb9e1190a1d6aef0a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6a86b900b7ca84e5d51cf0fbb9e1190a1d6aef0a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/4a9412d9/attachment-0001.htm>