-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 04 Nov 2026 16:08:23 +0100
Source: symfony
Architecture: source
Version: 7.4.23+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
symfony (7.4.23+dfsg-1) unstable; urgency=medium
.
[ Nicolas Grekas ]
* [Config] Do not validate XML documents on pars (GHSA-5jff-8h8q-r5qx)
* [HtmlSanitizer] Fix meta refresh URL sanitization bypass
(GHSA-wm2w-4mgj-vw33)
* [Validator] Reject non-public IP addresses in the no-priv, no-res
and only-public modes (GHSA-4qpf-57w4-m3wc)
* [HtmlSanitizer] Require special schemes and scheme-relative URLs to
carry a non-empty authority [CVE-2026-118517]
* [HttpClient] Don't send the options of the default scope to other
origins in ScopingHttpClient (GHSA-gq53-v8w2-gjhj)
* [Security] Run the checkPostAuth() method of user checkers when
authenticating users programmatically (GHSA-8f57-m8wj-x65w)
* [HttpClient] Pin the IP of cached hosts in NoPrivateNetworkHttpClient
(GHSA-c7hm-wqwp-f9v8)
* [Serializer] Lowercase the scheme of data URIs before opening them
(GHSA-pxj9-jh84-vhm5)
* [Security] Parse the DN into RDNs before extracting the user identifier
[CVE-2026-118513]
* [HttpKernel] Don't decode CSV and YAML payloads unless acceptFormat
lists them (GHSA-hwfg-qwvh-2wfx)
* [Serializer] Don't build UploadedFile and other file objects from
denormalized data [CVE-2026-118515]
* [HtmlSanitizer] Apply the URL policy to srcset and imagesrcset
(GHSA-q8jq-xrf4-v5j8)
* [HttpFoundation] Add the list of private ranges usable as trusted proxies
(GHSA-xg2q-4rrq-657q)
* [HttpKernel] Restore the router context of the parent request after a
sub-request (GHSA-wg5q-m2ww-f3c9)
* [Routing] Prevent host placeholders from matching the path in compiled
matchers [CVE-2026-118516]
* [Filesystem] Only treat a valid URI scheme as the root of a path
(GHSA-6prc-h956-hxjq)
* [Serializer] Ignore undeclared property paths when denormalizing
(GHSA-hqp2-7rr8-hf26)
* [HttpFoundation] Match HEAD requests when GET is listed in a RequestMatcher
[CVE-2026-118514]
* [HttpFoundation] Don't let Request::getBaseUrl() start with a host chosen by
the client (GHSA-5mx8-mwrp-5693)
* [JsonPath] Evaluate absolute queries in filters once per query instead of
once per node (GHSA-cpww-5vpx-72x7)
.
[ Fabien Potencier ]
* Update VERSION for 7.4.23
.
[ Jack Worman ]
* [HttpFoundation] Don't match the script name in Request::getBaseUrl() when
it's only the start of a path segment (GHSA-3h27-hjv7-fqjx)
.
[ David Prévot ]
* Set Multi-Arch: foreign for php-symfony-redis-messenger
Checksums-Sha1:
ff323256e63d87e8ac48c341c552d9ae7b4084ca 19158 symfony_7.4.23+dfsg-1.dsc
b8b458a2f63ae5dfacc689467b07de56fafa4dad 10470944 symfony_7.4.23+dfsg.orig.tar.xz
7d361db327794fedbff4841243729289167c99d1 84308 symfony_7.4.23+dfsg-1.debian.tar.xz
504553f57def94b5cf55b65e3ce4f8b2afc24549 74954 symfony_7.4.23+dfsg-1_amd64.buildinfo
Checksums-Sha256:
4855a542e826294352a8f730b58abc390014eeb325d339c5044611263ca73269 19158 symfony_7.4.23+dfsg-1.dsc
eb4642729bb6db5bc9bf434f62f37807e0cc3a749dd2fcf4d143287c818ef142 10470944 symfony_7.4.23+dfsg.orig.tar.xz
3ac69cc946f6b922780fcd78db219cf3977ac7173061370f959c9eca9d7aba9b 84308 symfony_7.4.23+dfsg-1.debian.tar.xz
81af151ea175fec425193645a689e1ac5cb07769f26e33c28a18bb14ad29ed2a 74954 symfony_7.4.23+dfsg-1_amd64.buildinfo
Files:
cc990adfbf257594384efea26530dd3c 19158 php optional symfony_7.4.23+dfsg-1.dsc
e05cf0de2023f98868007db08737d90d 10470944 php optional symfony_7.4.23+dfsg.orig.tar.xz
1643ca761209a0dbf9cacab0e991eb70 84308 php optional symfony_7.4.23+dfsg-1.debian.tar.xz
732c590c1702d6f040e7526a62cd043f 74954 php optional symfony_7.4.23+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmrrXvwSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08A2MH/2Oi6Rpo1K1326nzJnkIFe63zCMu5PAb
9PMUtM5C2gp4m1MwAeyfaJQ80wIjGxmmOcF23AqiwGmFRhjNdGebErNaL3WMkpzW
Ud2dejrOHCUg7eMcLUV2VsXc8v3eYDunD2NOdhi82mowSAcYomLVz2d1HTWEDG6P
+6Yk8eAopZVZ6ObwoQfpAxh7fMKpmUDWy+j0obWv06rW2DdTHoqE+vPDd0AaVYvk
EACniiFGFk1UQSYbleMlpCCVvmFVyIJs5enTnX3a5sQcLXByAAohbHD6MHxp0LmO
674EHRiLh5p1yfNP/82Yi7g1r2Zgqsyyah141kG1wJF7Mr9PEvckZmw=
=vM16
-----END PGP SIGNATURE-----
