CVE-2026-45063
published 2026-07-14CVE-2026-45063: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12…
PriorityP357critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.32%
24.5th percentile
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sensiolabs | symfony | < 5.4.52 | 5.4.52 |
| sensiolabs | symfony | >= 6.0.0 < 6.4.40 | 6.4.40 |
| sensiolabs | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| sensiolabs | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | security-http | >= 0 < 5.4.52 | 5.4.52 |
| symfony | security-http | >= 6.0.0-BETA1 < 6.4.40 | 6.4.40 |
| symfony | security-http | >= 7.0.0-BETA1 < 7.4.12 | 7.4.12 |
| symfony | security-http | >= 8.0.0-BETA1 < 8.0.12 | 8.0.12 |
| symfony | symfony | < 5.4.52 | 5.4.52 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 0 < 5.4.52 | 5.4.52 |
| symfony | symfony | >= 6.0.0-BETA1 < 6.4.40 | 6.4.40 |
| symfony | symfony | >= 7.0.0-BETA1 < 7.4.12 | 7.4.12 |
| symfony | symfony | >= 8.0.0-BETA1 < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.09.1CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Symfony incorrect regex
vuldb·2026-05-28
CVE-2026-45063 [LOW] Symfony incorrect regex
A vulnerability described as problematic has been identified in Symfony. This affects an unknown part. Such manipulation leads to incorrect regular expression.
This vulnerability is documented as CVE-2026-45063. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
ghsa·2026-05-27
CVE-2026-45063 [HIGH] CWE-290 Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
### Description
`X509Authenticator` implements client-certificate (mTLS) authentication: the web server validates the client's certificate against a trusted CA, then passes the certificate's Subject DN (Distinguished Name: a string like `CN=Alice,O=Example,[email protected]`) to Symfony via `$_SERVER['SSL_CLIENT_S_DN']`. Symfony extracts the user identifier from that string.
The extraction uses an **unanchored** regex that matches `emailAddress=` anywhere in the DN string: including inside the *value* of a different RDN (Relative Distinguished Name: one `key=value` component of the DN), such as `CN`. An attacker who can obtain a certificate from a trusted CA with a free-text `CN` can smuggl
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/symfony/symfony/commit/59ef484029601a7af06f5e06c6ed921fdcea5a0dhttps://github.com/symfony/symfony/releases/tag/v5.4.52https://github.com/symfony/symfony/releases/tag/v6.4.40https://github.com/symfony/symfony/releases/tag/v7.4.12https://github.com/symfony/symfony/releases/tag/v8.0.12https://github.com/symfony/symfony/security/advisories/GHSA-ph86-p8f6-f9r2
2026-07-14
Published