Symfony · Symfony/Validator · CVE-2024-50343
Name of the Vulnerable Software and Affected Versions:
symfony/validator versions 5.4.43, 6.4.11, and 7.1.4
Description:
The symfony/validator module in the Symphony PHP framework is vulnerable to a regex bypass issue. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `
`. This issue can be exploited by providing a specially crafted input. Symfony now uses the `D` regex modifier to match the entire input.
Recommendations:
For versions 5.4.43, 6.4.11, and 7.1.4, upgrade to a newer version that includes the patch for this issue.
As a temporary workaround, consider configuring the `Validator` to use the `D` regex modifier to match the entire input until a patch is available.