CVE-2016-1902
HighSummary
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library, and the openssl_random_pseudo_bytes function fails.
Risk Assessment
This makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors, potentially leading to the exposure of sensitive data.
Recommendation
It is recommended to update Symfony to the latest version and ensure that the paragonie/random_compat library is used when working with PHP 5.x.
Other vulnerabilities in Symfony
See all- CVE-2016-4423High
The attemptAuthentication function in Symfony before versions 2.3.41, 2.7.13, 2.8.6, and 3.0.6 does not limit the length of a username stored in a session. This allows remote attackers to cause a denial of service through a series of authentication attempts with long, non-existent usernames.
- CVE-2013-1397High
Symfony versions 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x are vulnerable to remote attacks that allow arbitrary PHP code execution via a serialized PHP object in the Yaml::parse or Yaml\Parser::parse functions.
- CVE-2013-1348High
The Yaml::parse function in Symfony 2.0.x before version 2.0.22 allows remote attackers to execute arbitrary PHP code via a PHP file, which is a different vulnerability than CVE-2013-1397.
- CVE-2026-47767Critical
A vulnerability in Symfony allows an attacker to manipulate the APP_ENV and APP_DEBUG environment variables via a crafted query string that bypasses the protection introduced in CVE-2024-50340. The issue stems from a discrepancy between parse_str() and the web SAPI, enabling attacker-controlled --env or --no-debug flags to be passed to the script.
- CVE-2026-45069Critical
In Symfony up to versions 6.4.40, 7.4.12, and 8.0.12, the OidcTokenHandler::verifyClaims() method registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(). This allowed a validly signed JWT missing those claims to pass verification.
- CVE-2026-45063Critical
A vulnerability in Symfony X509Authenticator allows an attacker with a trusted certificate to impersonate a victim by placing emailAddress= in another RDN value, such as CN, due to an unanchored regex.
- CVE-2016-2403Critical
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- CVE-2026-48784Medium
A vulnerability in Symfony allows an attacker to manipulate URL paths via controlled route parameters. The UrlGenerator::doGenerate() function uses strtr() dot-segment encoding that skips every other chained ../ or ./ segment, enabling generation of URLs that collapse to a different path under RFC 3986 normalization.
- CVE-2026-48761Medium
In Symfony PHP framework from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs bypassed sanitization, allowing javascript: payloads. Fixed in versions 6.4.41, 7.4.13, and 8.0.13.
- CVE-2026-48760Medium
A vulnerability in Symfony allows bypassing URL sanitization via percent-encoded BiDi formatting characters, enabling visual-spoofing character injection. Affects versions from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13.
Original NVD description (English source)
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.