All vulnerabilities

Servers and applications

CVE-2026-118513

X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063

Severity: High 7.7
Published: 4 Nov 2026
Last changed: 4 Nov 2026
Added to UpHeron: 4 Nov 2026
Fixed in: 5.4.56, 6.4.50, 7.4.23, 8.1.11
Also known as: GHSA-5w3m-mfwg-9f8r
Sources: Project advisories (GitHub)

Affected software

Software	Affected versions
SymfonyServers and applications · `github:symfony/symfony`	Every version before 5.4.56 From 6 before 6.4.50 From 7 before 7.4.23 From 8 before 8.1.11

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-118513
GitHub Advisory Database https://github.com/advisories/GHSA-5w3m-mfwg-9f8r
github.com https://github.com/symfony/symfony/security/advisories/GHSA-5w3m-mfwg-9f8r