CVE-2026-45077

Analyzed Analyzed - Analysis Complete

Unauthenticated PHP Object Injection in Symfony ServerLogCommand

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45077

EUVD

EUVD-2026-44330

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	to 5.4.52 (exc)
sensiolabs	symfony	From 6.0.0 (inc) to 6.4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

CVE-2026-45077 is a high-severity vulnerability in Symfony's MonologBridge component affecting the server:log command. It allows unauthenticated remote attackers to execute arbitrary code or cause denial of service by sending malicious serialized PHP payloads to a default TCP listener bound to port 9911 on all network interfaces. The issue stems from unsafe defaults including no authentication, no input validation, and unsafe use of unserialize() without an allowlist.

Detection Guidance

Check if the Symfony server:log listener is running on port 9911 by default. Use netstat or ss to verify if port 9911 is open and listening on all interfaces (0.0.0.0:9911). If it is, the system may be vulnerable. Commands: netstat -tulnp | grep 9911 or ss -tulnp | grep 9911.

Impact Analysis

This vulnerability allows remote attackers to crash the Symfony server:log listener or execute arbitrary code on your system. An attacker could exploit this to gain control of your server, steal data, or disrupt services. The default configuration exposes the listener to all network interfaces, making it accessible from any reachable host.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. Organizations using affected Symfony versions may face compliance violations, regulatory fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade Symfony to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 or later. If upgrading is not possible, restrict the server:log listener to localhost by modifying the configuration to bind to 127.0.0.1:9911 instead of 0.0.0.0:9911. Ensure no external access is allowed to port 9911.

Hi! I’m here to help you understand CVE-2026-45077. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70