# Symfony patches multiple DoS vulnerabilities

Published: 2026-10-15 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/1c48e5f0-5cdb-5a7d-af17-28022c9cdca2/symfony-patches-multiple-dos-vulnerabilities

> CERT-FR advisory details multiple Symfony vulnerabilities allowing remote denial of service; patches available across several affected packages.

CERT-FR has published an advisory covering multiple vulnerabilities in Symfony components, including symfony/expression-language, symfony/http-foundation, symfony/symfony, and symfony/yaml. These flaws allow a remote attacker to cause a denial of service condition. No evidence of active exploitation is mentioned in the advisory.

Affected versions span the 5.4.x, 6.x, 7.x, and 8.x branches, with fixes available in versions 5.4.54, 6.4.45/6.4.46/6.4.48, 7.4.18/7.4.19/7.4.21, and 8.1.6/8.1.7/8.1.9 depending on the component. Three CVEs (CVE-2026-108082, CVE-2026-109413, CVE-2026-109449) are referenced alongside corresponding GitHub Security Advisories published by the Symfony project on October 15, 2026.

Defenders running Symfony-based applications should identify which of the affected packages (expression-language, http-foundation, symfony core, yaml) are in use and upgrade to the patched versions referenced in the vendor's security bulletins. No workarounds beyond patching are described in this advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2026-108082, CVE-2026-109413, CVE-2026-109449

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1324

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1c48e5f0-5cdb-5a7d-af17-28022c9cdca2/symfony-patches-multiple-dos-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup