NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

Symfony DoSGHSA-r2rq-3h56-fqm4

MEDIUM

GHSA-r2rq-3h56-fqm4 is a medium-severity (CVSS 5.9) CWE-613 vulnerability in symfony/symfony. A fix is available for symfony/symfony — see the affected versions and patch details below.

Also known asCVE-2018-11386
Published
Updated
Affected
10 pkgs
Patched
10 / 10
Exploits
None indexed
Exploitation data as of Nov 7, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs76th percentile — riskier than 76% of all scored CVEsHighest risk
0.59%1.09%1.60%2.11%1.1%1.6%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

10 pkgs affected
🐘symfony/symfony🐘symfony/symfony🐘symfony/symfony🐘symfony/symfony🐘symfony/symfony🐘symfony/http-foundation🐘symfony/http-foundation🐘symfony/http-foundation+2 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

Affected Packages

10 total 10 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistsymfony/symfony≥ 2.7.0&&< 2.7.482.7.48composer require symfony/symfony:^2.7.48
🐘Packagistsymfony/symfony≥ 2.8.0&&< 2.8.412.8.41composer require symfony/symfony:^2.8.41
🐘Packagistsymfony/symfony≥ 3.3.0&&< 3.3.173.3.17composer require symfony/symfony:^3.3.17
🐘Packagistsymfony/symfony≥ 3.4.0&&< 3.4.113.4.11composer require symfony/symfony:^3.4.11
🐘Packagistsymfony/symfony≥ 4.0.0&&< 4.0.114.0.11composer require symfony/symfony:^4.0.11
🐘Packagistsymfony/http-foundation≥ 2.7.0&&< 2.7.482.7.48composer require symfony/http-foundation:^2.7.48

Affected Products

2 products · 6 configurations
OS
debian linuxdebian
1 version
9.0
Application
symfonysensiolabs
≥ 4.0.0 && < 4.0.11
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for symfony/symfony, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update symfony/symfony to 2.7.48 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r2rq-3h56-fqm4 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
O3 Security · Impact-Aware SCA

Is GHSA-r2rq-3h56-fqm4 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Symfony DoS (Medium 5.9)