CVE-2026-45077

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.52 Symfony versions prior to 6.4.40 Symfony versions prior to 7.4.12 Symfony versions prior to 8.0.12

Description The server:log console command, implemented in SymfonyBridgeMonologCommandServerLogCommand, contains a PHP object-deserialization flaw. The listener binds to 0.0.0.0:9911 by default, making it accessible from any reachable host. It processes incoming frames using unserialize(base64 decode($message)) without authentication, integrity checks, or an allowed classes allowlist. This allows remote attackers to submit serialized PHP payloads, which can lead to a denial of service by crashing the listener or potentially trigger remote code execution through object-injection gadget effects, depending on the available gadget chains in the environment.

Recommendations Update to version 5.4.52 or later. Update to version 6.4.40 or later. Update to version 7.4.12 or later. Update to version 8.0.12 or later. As a temporary mitigation, restrict access to TCP port 9911 or avoid running the server:log command on interfaces exposed to untrusted networks.