Critical severity9.1OSV Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-45063
CVE-2026-45063
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
symfony/security-httpPackagist | < 5.4.52 | 5.4.52 |
symfony/security-httpPackagist | >= 6.0.0-BETA1, < 6.4.40 | 6.4.40 |
symfony/security-httpPackagist | >= 7.0.0-BETA1, < 7.4.12 | 7.4.12 |
symfony/security-httpPackagist | >= 8.0.0-BETA1, < 8.0.12 | 8.0.12 |
symfony/symfonyPackagist | < 5.4.52 | 5.4.52 |
symfony/symfonyPackagist | >= 6.0.0-BETA1, < 6.4.40 | 6.4.40 |
symfony/symfonyPackagist | >= 7.0.0-BETA1, < 7.4.12 | 7.4.12 |
symfony/symfonyPackagist | >= 8.0.0-BETA1, < 8.0.12 | 8.0.12 |
Affected products
1- Range: v5.4.51, v8.0.11, v7.4.11, …
Patches
Vulnerability mechanics
References
11- github.com/symfony/symfony/commit/59ef484029601a7af06f5e06c6ed921fdcea5a0dnvdPatch
- github.com/symfony/symfony/security/advisories/GHSA-ph86-p8f6-f9r2nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-ph86-p8f6-f9r2ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45063.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45063.yamlghsaWEB
- github.com/symfony/symfony/commit/ccb3f724c7ff55670a6fe3521c7bf1514cceb478ghsaWEB
- github.com/symfony/symfony/releases/tag/v5.4.52nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v6.4.40nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v7.4.12nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v8.0.12nvdProductRelease Notes
- symfony.com/cve-2026-45063ghsaWEB
News mentions
0No linked articles in our index yet.