There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address
    (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and
    throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email
    addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\r\n`
    bytes — e.g. `"x\r\nBcc: attacker@evil"@example.com`. The stored address is later emitted verbatim into
    (1) the rendered message headers and (2) `SmtpTransport`'s `MAIL FROM:<...>` / `RCPT TO:<...>` protocol
    lines, turning the embedded CRLF into a new mail header and/or a new SMTP command. ### Resolution The
    `Address` constructor now rejects addresses containing line breaks. The patch for this issue is available
    [here](https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604) for branch 5.4.
    ### Credits We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue
    and providing the fix. (CVE-2026-45067)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address     (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and     throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email     addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\r\n`     bytes  e.g. `x\r\nBcc: attacker@evil@example.com`. The stored address is later emitted verbatim into     (1) the rendered message headers and (2) `SmtpTransport`'s `MAIL FROM:<...>` / `RCPT TO:<...>` protocol     lines, turning the embedded CRLF into a new mail header and/or a new SMTP command. ### Resolution The     `Address` constructor now rejects addresses containing line breaks. The patch for this issue is available     [here](https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604) for branch 5.4.
    ### Credits We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue     and providing the fix. (CVE-2026-45067)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6312 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6312-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 31, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : symfony     CVE ID         : CVE-2024-50340 CVE-2026-45063 CVE-2026-45064 CVE-2026-45065                      CVE-2026-45066 CVE-2026-45067 CVE-2026-45068 CVE-2026-45069                      CVE-2026-45071 CVE-2026-45072 CVE-2026-45073 CVE-2026-45077                      CVE-2026-45133 CVE-2026-45304 CVE-2026-45305 CVE-2026-45754                      CVE-2026-46626 CVE-2026-48489 CVE-2026-48736 CVE-2026-48760                      CVE-2026-48761 CVE-2026-48784

    Multiple vulnerabilities have been found in the Symfony PHP framework     which could lead to a bypass of security controls, cross-site scripting,     denial of service, SQL injection, email header injection, information     disclosure or code execution via PHP object deserialization.

    For the stable distribution (trixie), these problems have been fixed in     version 6.4.41+dfsg-0+deb13u1.

    We recommend that you upgrade your symfony packages.

    For the detailed security status of symfony please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/symfony

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Symfony and/or its Symfony Monolog Bridge / MIME / Mailer / Routing / Security HTTP Components installed on the remote host is/are prior to 6.1.x prior to 6.4.40, 7.0.x prior to 7.4.12, 8.0.x prior to 8.0.12, and, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability exists in Symfony Component's X509Authenticator client-certificate     (mTLS) authentication due to use of an unanchored regex to extract the emailAddress from the Subject DN     string. An unauthenticated, remote attacker can exploit this, via a crafted client certificate containing     an emailAddress string embedded within the CN (Common Name) field, to bypass authentication and impersonate     arbitrary users. (CVE-2026-45063)

  - An unsafe deserialization vulnerability exists in Symfony Monolog Bridge Component's ServerLogCommand     (server:log console command) due to binding to all network interfaces (0.0.0.0:9911) by default and     performing unauthenticated PHP object deserialization without an allowed_classes, allowlist, or integrity     checks. An unauthenticated, remote attacker can exploit this, via crafted serialized PHP payloads sent to     TCP port 9911, to cause a denial of service or potentially achieve remote code execution through PHP object     injection with magic-method side effects, depending on available gadget chains in the target environment.
    (CVE-2026-45077)

  - A CRLF injection vulnerability exists in Symfony MIME Component's Address class due to the constructor     accepting email addresses with quoted local-parts containing raw \r\n bytes, despite being documented as     validating input. An authenticated, remote attacker can exploit this, via crafted email addresses with     embedded CRLF sequences in the local-part (e.g., 'x\r\nBcc: attacker@evil'@example.com), to inject arbitrary     email headers and SMTP commands, enabling unauthorized email disclosure, spam relay, or other mail-system     abuse. (CVE-2026-45067)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager, PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for CVE-2026-45063, CVE-2026-45065, CVE-2026-45067, CVE-2026-45068, and CVE-2026-45077 to check for backported fixes.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6317 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6317-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 01, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : symfony     CVE ID         : CVE-2024-50340 CVE-2026-45063 CVE-2026-45065 CVE-2026-45067                      CVE-2026-45068 CVE-2026-45071 CVE-2026-45073 CVE-2026-45077                      CVE-2026-45133 CVE-2026-45304 CVE-2026-45305 CVE-2026-46626                      CVE-2026-48489 CVE-2026-48736 CVE-2026-48784

    Multiple vulnerabilities have been found in the Symfony PHP framework     which could lead to a bypass of security controls, cross-site scripting,     denial of service, SQL injection, email header injection, information     disclosure or code execution via PHP object deserialization.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 5.4.53+dfsg-0+deb12u1.

    We recommend that you upgrade your symfony packages.

    For the detailed security status of symfony please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/symfony

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
442416	SCA: security update for symfony/mime, symfony/symfony (GHSA-qpmx-3rfj-7rhv)	Tenable Self-Hosted Container Security	SCA Checks	5/28/2026	7/15/2026	medium
442416	SCA: security update for symfony/mime, symfony/symfony (GHSA-qpmx-3rfj-7rhv)	Tenable Cloud Security	SCA Checks	5/28/2026	7/15/2026	medium
316025	Linux Distros Unpatched Vulnerability : CVE-2026-45067	Nessus	Misc.	5/21/2026	9/2/2026	medium
318121	Debian dsa-6312 : php-symfony - security update	Nessus	Debian Local Security Checks	6/1/2026	9/18/2026	critical
318791	Symfony and Multiple Symfony Components < 5.4.52 / 6.x < 6.4.40 / 7.x < 7.4.12 / 8.x < 8.0.12 Multiple Vulnerabilities	Nessus	Misc.	6/5/2026	9/22/2026	critical
318254	Debian dsa-6317 : php-symfony - security update	Nessus	Debian Local Security Checks	6/2/2026	9/18/2026	critical

Detections

Analytics

Plugins Search

medium

medium

medium

critical

critical

critical