Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2024-50343

Incorrect response from Validator when input ends with `\n` in symfony/validator

Description

symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

symfony symfony

  • < 5.4.43affected
  • >= 6.0.0, < 6.4.11affected
  • >= 7.0.0, < 7.1.4affected

References