CVE-2026-45077

UNKNOWN 0.0

Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CWE	CWE-502 CWE-668
Vendor	symfony
Product	symfony
Published	Jul 14, 2026
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for symfony symfony

Be the first to know when new unknown vulnerabilities affecting symfony symfony are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

symfony / symfony

< 5.4.52 >= 6.0.0-BETA1, < 6.4.40 >= 7.0.0-BETA1, < 7.4.12 >= 8.0.0-BETA1, < 8.0.12

symfony / monolog-bridge

< 5.4.52 >= 6.0.0-BETA1, < 6.4.40 >= 7.0.0-BETA1, < 7.4.12 >= 8.0.0-BETA1, < 8.0.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/symfony/symfony/security/advisories/GHSA-m7v2-7gxm-vc2v github.com: https://github.com/symfony/symfony/commit/0891b2f293896c488e26943dc034334364b77fc4 github.com: https://github.com/symfony/symfony/releases/tag/v5.4.52 github.com: https://github.com/symfony/symfony/releases/tag/v6.4.40 github.com: https://github.com/symfony/symfony/releases/tag/v7.4.12 github.com: https://github.com/symfony/symfony/releases/tag/v8.0.12