Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

symfony/monolog-bridge

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1PackagistPublished

    Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

    CVE-2026-45077 · GHSA-m7v2-7gxm-vc2v

    Affected
    • Packagist symfony/monolog-bridge < 5.4.52; >= 6.0.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12
    Fixed in
    8.0.127.4.126.4.405.4.52· Vendor fix available
    Issue
    Symfony\Bridge\Monolog\Command\ServerLogCommand (the server:log console command) is a development-time helper that opens a TCP listener and displays log records pushed to it by the application's logging pipeline. Two unsafe defaults combine into a remotely reachable PHP object-deserialization sink: 1. The listener binds to 0.0.0.0:9911 by default; it accepts connections on every interface, not only loopback. 2. Each received frame is processed as unserialize(base64decode($message)) without an allowedclasses allowlist, without authentication, and without any integrity check. The decoded value is then passed to displayLog(..., array $record) which assumes (without validating) that the result is an array. Any host that can reach TCP port 9911 on a machine running server:log can therefore submit attacker-chosen serialized PHP payloads. The minimum impact is an unauthenticated denial of service (sending a non-array, e.g. serialize(new stdClass()), crashes the listener with a…

    Recommended action: Upgrade to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →