CVE-2024-50343

Published: Nov 6, 2024Modified: Jun 17, 2026Deferred

3.1

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://github.com/symfony/symfony/commit/7d1032bbead9a4229b32fa6ebca32681c80cb76f

Source: security-advisories@github.com

https://github.com/symfony/symfony/security/advisories/GHSA-g3rh-rrhp-jhh9

Source: security-advisories@github.com

https://lists.debian.org/debian-lts-announce/2025/05/msg00051.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.