CVE-2026-45754

NameCVE-2026-45754
DescriptionSymfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6312-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
symfony (PTS)bullseye4.4.19+dfsg-2+deb11u6fixed
bullseye (security)4.4.19+dfsg-2+deb11u7fixed
bookworm, bookworm (security)5.4.53+dfsg-0+deb12u1fixed
trixie (security), trixie6.4.41+dfsg-0+deb13u1fixed
forky, sid7.4.14+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
symfonysourcebullseye(not affected)
symfonysourcebookworm(not affected)
symfonysourcetrixie6.4.41+dfsg-0+deb13u1DSA-6312-1
symfonysource(unstable)7.4.12+dfsg-1

Notes

[bookworm] - symfony <not-affected> (Vulnerable code not present, introduced in 6.4)
[bullseye] - symfony <not-affected> (Vulnerable code not present, introduced in 6.4)
https://symfony.com/blog/cve-2026-45754-mailjet-and-lox24-webhook-parsers-never-verify-the-configured-secret-unauthenticated-event-injection

Search for package or bug name: Reporting problems