Problem/Motivation

Symfony released a number of CVEs this week. We should update our lockfile versions accordingly on 10.6.x and the 11.x versions.

(12.0.x and main will be handled separately in #3634655: Update to Symfony 8.2.0-BETA1 when it is available.)

Steps to reproduce

On 11.x:

composer audit --locked --format=plain

Yields:

Found 13 security vulnerability advisories affecting 8 packages:
Package: symfony/filesystem
Severity: 
Advisory ID: PKSA-g499-cm4q-v35y
CVE: NO CVE
Title: Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory
URL: https://github.com/symfony/symfony/security/advisories/GHSA-6prc-h956-hxjq
Affected versions: >=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00
--------
Package: symfony/http-foundation
Severity: 
Advisory ID: PKSA-24ph-xkrh-y79j
CVE: CVE-2026-118514
Title: CVE-2026-118514: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075
URL: https://symfony.com/cve-2026-118514
Affected versions: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T10:45:07+00:00
--------
Package: symfony/http-foundation
Severity: 
Advisory ID: PKSA-pr6q-2w5s-kzzf
CVE: NO CVE
Title: Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name
URL: https://github.com/symfony/symfony/security/advisories/GHSA-3h27-hjv7-fqjx
Affected versions: >=5.4.50,<5.4.56|>=6.4.29,<6.4.50|>=7.3.7,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00
--------
Package: symfony/http-foundation
Severity: 
Advisory ID: PKSA-nxjs-s6hn-vb6m
CVE: NO CVE
Title: The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies
URL: https://github.com/symfony/symfony/security/advisories/GHSA-xg2q-4rrq-657q
Affected versions: >=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00
--------
Package: symfony/http-foundation
Severity: 
Advisory ID: PKSA-b2gg-vk1g-6d5q
CVE: NO CVE
Title: Generated URLs Can Point to a Host Chosen by the Client
URL: https://github.com/symfony/symfony/security/advisories/GHSA-5mx8-mwrp-5693
Affected versions: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.8.0|>=2.8.0,<3.0.0|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<4.0.0|>=4.0.0,<4.1.0|>=4.1.0,<4.2.0|>=4.2.0,<4.3.0|>=4.3.0,<4.4.0|>=4.4.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00
--------
Package: symfony/http-kernel
Severity: 
Advisory ID: PKSA-3gxv-7xhq-mgmz
CVE: NO CVE
Title: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
URL: https://github.com/symfony/symfony/security/advisories/GHSA-wg5q-m2ww-f3c9
Affected versions: >=2.8.44,<3.0.0|>=3.4.14,<4.0.0|>=4.0.14,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00
--------
Package: symfony/mime
Severity: medium
Advisory ID: PKSA-wtxr-p26d-nn42
CVE: CVE-2026-45070
Title: CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
URL: https://symfony.com/cve-2026-45070
Affected versions: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.55|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.49|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.22|>=8.0.0,<8.1.0|>=8.1.0,<8.1.10
Reported at: 2026-10-28T18:08:54+00:00
--------
Package: symfony/routing
Severity: 
Advisory ID: PKSA-y8c5-1b7f-r1gj
CVE: CVE-2026-118516
Title: CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
URL: https://symfony.com/cve-2026-118516
Affected versions: >=4.1.0,<4.2.0|>=4.2.0,<4.3.0|>=4.3.0,<4.4.0|>=4.4.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T10:45:07+00:00
--------
Package: symfony/serializer
Severity: 
Advisory ID: PKSA-grh8-hvfp-h9pf
CVE: CVE-2026-118515
Title: CVE-2026-118515: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File
URL: https://symfony.com/cve-2026-118515
Affected versions: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T10:45:07+00:00
--------
Package: symfony/serializer
Severity: 
Advisory ID: PKSA-nyd8-k74r-fsf2
CVE: NO CVE
Title: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
URL: https://github.com/symfony/symfony/security/advisories/GHSA-pxj9-jh84-vhm5
Affected versions: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00
--------
Package: symfony/serializer
Severity: 
Advisory ID: PKSA-y18k-qjc6-knrv
CVE: NO CVE
Title: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
URL: https://github.com/symfony/symfony/security/advisories/GHSA-hqp2-7rr8-hf26
Affected versions: >=5.4.41,<5.4.56|>=6.4.9,<6.4.50|>=7.0.9,<7.1.0|>=7.1.2,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00
--------
Package: symfony/validator
Severity: 
Advisory ID: PKSA-68kf-8d6f-hdsy
CVE: NO CVE
Title: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass
URL: https://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc
Affected versions: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00
--------
Package: symfony/yaml
Severity: 
Advisory ID: PKSA-nktx-f1n1-b4yd
CVE: NO CVE
Title: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
URL: https://github.com/symfony/symfony/security/advisories/GHSA-hwfg-qwvh-2wfx
Affected versions: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported at: 2026-11-04T00:00:00+00:00

Proposed resolution

Update the lockfile versions of the affected packages. Increase constraints if Drupal core is directly vulnerable to a specific issue.

composer update drupal/core symfony/filesystem symfony/http-foundation symfony/http-kernel symfony/mime symfony/routing symfony/serializer symfony/validator symfony/yaml

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3635859

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

xjm created an issue. See original summary.

xjm’s picture

xjm
she/her
Primary language English
commented
Version: 11.1.x-dev » 11.x-dev

xjm opened merge request !17714

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Needs review
xjm’s picture

xjm
she/her
Primary language English
commented
Issue summary: View changes

xjm opened merge request !17715

xjm opened merge request !17716

xjm opened merge request !17717

xjm opened merge request !17718

xjm’s picture

xjm
she/her
Primary language English
commented
Issue tags: +10.6.21 release notes, +11.3.21 release notes, +11.4.12 release notes, +11.5.0-rc1 release notes

  • longwave committed 19cffa3c on 11.x 
    task: #3635859 Update lockfile versions of Symfony versions in supported...

  • longwave committed 91eb1a87 on 11.5.x 
    task: #3635859 Update lockfile versions of Symfony versions in supported...

  • longwave committed 075b3092 on 11.4.x 
    task: #3635859 Update lockfile versions of Symfony versions in supported...

  • longwave committed 8f260b45 on 11.3.x 
    task: #3635859 Update lockfile versions of Symfony versions in supported...

  • longwave committed f45fd0fc on 10.6.x 
    task: #3635859 Update lockfile versions of Symfony versions in supported...
longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Needs review » Fixed

All looks present and correct to me. Committed and pushed to their respective branches, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.