CVE-2018-11386

Vulnerability

The PDOSessionHandler class in Symfony's http-foundation component (versions 2.7.0–2.7.47, 2.8.0–2.8.40, 3.3.0–3.3.16, 3.4.0–3.4.10, and 4.0.0–4.0.10) allows storing PHP sessions on a PDO connection. Under certain conditions, a specially crafted session payload causes an infinite loop, leading to a denial of service [2].

Exploitation

An attacker must: (1) identify an application using PDOSessionHandler to store sessions, (2) confirm MySQL is the backend, and (3) verify that the MySQL sql_mode does not include STRICT_ALL_TABLES or STRICT_TRANS_TABLES (e.g., by checking SELECT @@sql_mode). With those preconditions met, a well-crafted session payload sent by the attacker triggers the infinite loop [2][3]. No authentication is required; the attacker simply submits the malicious session data.

Impact

Successful exploitation causes a denial of service by consuming server resources (CPU) as the loop runs indefinitely. No data is disclosed, modified, or permanently destroyed, but the application becomes unresponsive [1][2].

Mitigation

Symfony fixed the issue in versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, and 4.0.11 (also fixed before the final release of 4.1.0) [2][3]. Users are strongly advised to upgrade to a patched version. No workaround is available if upgrading is not possible; switching to a different session handler or enabling strict SQL modes might prevent exploitation but is not an official patch. Versions 3.0, 3.1, and 3.2 are end-of-life and are not patched [2][3].