Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to
    7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as
    algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm
    downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in
    versions 7.4.13 and 8.0.13. (CVE-2026-48747)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to     7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as     algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm     downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in     versions 7.4.13 and 8.0.13. (CVE-2026-48747)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
443188	SCA: security update for symfony/mailomat-mailer, symfony/symfony (GHSA-rrj9-5q2j-4gvr)	Tenable Cloud Security	SCA Checks	Local	medium
443188	SCA: security update for symfony/mailomat-mailer, symfony/symfony (GHSA-rrj9-5q2j-4gvr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
317347	Linux Distros Unpatched Vulnerability : CVE-2026-48747	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-48747

medium

Tenable Plugins

medium

medium

medium