Backend framework
Symfony: supported versions and open vulnerabilities today
Symfony 8.1, 7.4, 6.4 and 5.4 are supported (8.1 until Jan 31, 2027); 8.0 reached end of life on Jul 31, 2026; the latest release is 8.1.9. 6 high or critical advisories for Symfony were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 8.1.9
- GitHub stars
- 31.2k
- Licence
- MIT
- OpenSSF Scorecard
- 7.5 / 10
Supported versions
Security advisories
31 advisories published in the last 12 months, 6 of them high or critical. 100 in total since records began. Checked packages: symfony/symfony.
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Fixed in 5.4.53, 6.4.41, 7.4.13 and 8.0.13.
EPSS: top 53%Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Fixed in 7.4.12 and 8.0.12.
EPSS: top 65%Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
Fixed in 5.4.52, 6.4.40, 7.4.12 and 8.0.12.
EPSS: top 50%Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Fixed in 5.4.52, 6.4.40, 7.4.12 and 8.0.12.
EPSS: top 72%Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Fixed in 5.4.52, 6.4.40, 7.4.12 and 8.0.12.
EPSS: top 53%Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Fixed in 5.4.50, 6.4.29 and 7.3.7.
EPSS: top 28%
Maintenance and supply chain
OpenSSF Scorecard 7.5 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 5 issue updates found in the last 90 days.
Weakest checks
- No static analysis (SAST 0/10)
- No fuzzing (Fuzzing 0/10)
Docs and release notes
Check Symfony in your own stack
This page checks Symfony in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.