-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 27 May 2026 19:56:10 +0200
Source: symfony
Architecture: source
Version: 6.4.41+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
 symfony (6.4.41+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Fabien Potencier ]
   * Update VERSION for 6.4.41
 .
   [ Nicolas Grekas ]
   * [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces
     in URLs [CVE-2026-45064]
   * [MonologBridge] Bind server:log to localhost by default [CVE-2026-45077]
   * [Yaml] Bound recursion depth in the parser [CVE-2026-45133]
   * [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() [CVE-2026-45072]
   * [Cache] Validate the prefix given to AbstractAdapter::clear()
     [CVE-2026-45073]
   * [Yaml] Bound collection-alias resolution in the parser [CVE-2026-45304]
   * [Yaml] Harden the Parser::cleanup() regexes against catastrophic
     backtracking [CVE-2026-45305]
   * [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on
     $_SERVER['QUERY_STRING'] [CVE-2026-46626]
   * [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient
     [CVE-2026-48736]
   * [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS
     [CVE-2026-48736]
   * [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace
      in URLs [CVE-2026-48760]
   * [HtmlSanitizer] Sanitize URL attributes on <object>, <applet>, <iframe>,
     <img>, and the URL inside <meta http-equiv="refresh"> content
     [CVE-2026-48761]
   * [Routing] Fix dot-segment encoding for chained "../" and "./" in generated
     URLs [CVE-2026-48784]
   * [Security] Don't honor user-supplied _failure_path on failure_forward
     [CVE-2026-48489]
 .
   [ Alexandre Daubois ]
   * [Routing] Fix regex alternation anchoring in UrlGenerator requirement
     validation [CVE-2026-45065]
   * [DomCrawler] Fix XXE in addXmlContent() by not enabling `validateOnParse`
     [CVE-2026-45071]
   * [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser
     differentials and <area> misclassification [CVE-2026-45066]
   * [Security] Add missing claims in `OidcTokenHandler` [CVE-2026-45069]
   * [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator
     [CVE-2026-45063]
   * [Mime] Reject email addresses containing line breaks in Address
     [CVE-2026-45067]
   * [Mailer] Add end-of-options separator before recipients in
     SendmailTransport; reject addresses starting with a dash [CVE-2026-45068]
   * [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials
     [CVE-2026-45754]
Checksums-Sha1:
 134554c1dfcb68d673eb89a0c0537e53d75621c1 16771 symfony_6.4.41+dfsg-0+deb13u1.dsc
 27c32d81117e02a728dbca200ae01d5375fd9a30 8773824 symfony_6.4.41+dfsg.orig.tar.xz
 4bad294031b5650e584bdf444c4a01c2623a9ea5 79176 symfony_6.4.41+dfsg-0+deb13u1.debian.tar.xz
 1cd8beb61840d7c90878f938a985b2d2f83a457a 71613 symfony_6.4.41+dfsg-0+deb13u1_i386.buildinfo
Checksums-Sha256:
 6d9136ed0a864da685f1938f1562d1113e7b1a425c35c81bece32ddd174d13fe 16771 symfony_6.4.41+dfsg-0+deb13u1.dsc
 cb5a93b47cbfea37894e6907bdcf2e75373ca10fc377c85a58c4aeaae11d6083 8773824 symfony_6.4.41+dfsg.orig.tar.xz
 b269532472c5881ce090cb6193a5f63cea725e92d2633c953a45f07afbab6212 79176 symfony_6.4.41+dfsg-0+deb13u1.debian.tar.xz
 60bef30803cc851011e0b850dbdad010efd4eb5267c6010ef77a464ab226cfec 71613 symfony_6.4.41+dfsg-0+deb13u1_i386.buildinfo
Files:
 8f3aad631aea8d8803b6af366d5a3805 16771 php optional symfony_6.4.41+dfsg-0+deb13u1.dsc
 a50992625fa71b57d933f95a5ef79d56 8773824 php optional symfony_6.4.41+dfsg.orig.tar.xz
 0b14214dd0ca1935544e16531e0e1b0e 79176 php optional symfony_6.4.41+dfsg-0+deb13u1.debian.tar.xz
 58f67dfdbf1b1550b6ae735bd8fc428c 71613 php optional symfony_6.4.41+dfsg-0+deb13u1_i386.buildinfo

-----BEGIN PGP SIGNATURE-----

iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmoYs/ISHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08i3oH/1eNy40d5+dnfiRE+A4skxM+pMqI9omb
q2awpyGawxQPULTNEEjwyp7ru4fdyN2K2DsqDCUpGA1ZwCT7/cqWQYDQRGMZNntP
qOzDCF+d2KYhSREeSZ0NlP4DFXyA+kmv2LTDIa3yXyIXVMfhOXaU7RzfTO2KmNmo
kSpfTWS6hCwQh5JWbge44FamIC+PLWrxAx2QXaJJcDXwCK90a1NRz2GFdA60aSKn
83n81uZbj0xjdVAkQrHIM8t6+7sa6LhSjoru2XmQYLb6Z1XLsKqfaM2VRLyXUCKR
TtTLCnKUoTUlX93Dky+igMMduALiAQgSPC8b+/ZwVyqtacEIJwQizPE=
=DNRF
-----END PGP SIGNATURE-----