PHP package security

Is symfony/security-core vulnerable?

Q: Does symfony/security-core have known vulnerabilities?

Yes. Packagist lists 5 security advisories for symfony/security-core (3 critical, 1 high, 1 medium severity). The most recent, reported 2021-05-12, is "CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms". The newest release, 8.1.10, is outside every affected range.

Q: Which version of symfony/security-core should I run?

The newest stable release is 8.1.10 (published 2026-10-25). The most recent advisory is fixed in 3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.49, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.4.24, 5.1.0, 5.2.0 and 5.2.9, so stay on or above the fixed version for your major version. Run composer update symfony/security-core, then composer audit to confirm nothing else is flagged.

Q: How do I check if my symfony/security-core version is affected?

Run composer show symfony/security-core in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.

5 known security advisories for symfony/security-core. The latest was reported on 2021-05-12 and is fixed in 3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.49, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.4.24, 5.1.0, 5.2.0 and 5.2.9. The newest release, 8.1.10, is not affected by any of them.

3 critical 1 high 1 medium

Known advisories: 5
Newest release: 8.1.10
Released: 2026-10-25
Affecting newest release: 0
Last synced: 2026-11-03

Symfony Security Component - Core Library · packagist.org/packages/symfony/security-core

Check your version

Run composer show symfony/security-core in your project to see the installed version, then enter it here.

Security advisories for symfony/security-core

Newest first. “Affected” is the Composer version constraint from the advisory; “fixed in” is each version the advisory names as the first safe one on its release line.

Reported	Advisory	Severity	Affected	Fixed in
2021-05-12	CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms CVE-2021-21424 · GitHub, FriendsOfPHP/security-advisories	medium	>=2.8.0,<3.0.0 \| >=3.0.0,<3.1.0 \| >=3.1.0,<3.2.0 \| >=3.2.0,<3.3.0 \| >=3.3.0,<3.4.0 \| >=3.4.0,<3.4.49 \| >=4.0.0,<4.1.0 \| >=4.1.0,<4.2.0 \| >=4.2.0,<4.3.0 \| >=4.3.0,<4.4.0 \| >=4.4.0,<4.4.24 \| >=5.0.0,<5.1.0 \| >=5.1.0,<5.2.0 \| >=5.2.0,<5.2.9	3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.49, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.4.24, 5.1.0, 5.2.0, 5.2.9
2018-05-25	CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password CVE-2018-11407 · GitHub, FriendsOfPHP/security-advisories	critical	>=2.8.0,<2.8.37 \| >=3.0.0,<3.1.0 \| >=3.1.0,<3.2.0 \| >=3.2.0,<3.3.0 \| >=3.3.0,<3.3.17 \| >=3.4.0,<3.4.7 \| >=4.0.0,<4.0.7	2.8.37, 3.1.0, 3.2.0, 3.3.0, 3.3.17, 3.4.7, 4.0.7
2017-07-17	CVE-2017-11365: Empty passwords validation issue CVE-2017-11365 · GitHub, FriendsOfPHP/security-advisories	critical	>=2.7.30,<2.7.32 \| >=2.8.23,<2.8.25 \| >=3.2.10,<3.2.12 \| >=3.3.3,<3.3.5	2.7.32, 2.8.25, 3.2.12, 3.3.5
2016-05-09	CVE-2016-2403: Unauthorized access on a misconfigured Ldap server when using an empty password CVE-2016-2403 · GitHub, FriendsOfPHP/security-advisories	critical	>=2.8.0,<2.8.6 \| >=3.0.0,<3.0.6	2.8.6, 3.0.6
2016-01-14	CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails CVE-2016-1902 · GitHub, FriendsOfPHP/security-advisories	high	>=2.4.0,<2.5.0 \| >=2.5.0,<2.6.0 \| >=2.6.0,<2.6.13 \| >=2.7.0,<2.7.9	2.5.0, 2.6.0, 2.6.13, 2.7.9

Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.

Ask about a fix

Check your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.

Check composer.lock

Questions about symfony/security-core

Does symfony/security-core have known vulnerabilities?

Yes. Packagist lists 5 security advisories for symfony/security-core (3 critical, 1 high, 1 medium severity). The most recent, reported 2021-05-12, is "CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms". The newest release, 8.1.10, is outside every affected range.

Which version of symfony/security-core should I run?

The newest stable release is 8.1.10 (published 2026-10-25). The most recent advisory is fixed in 3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.49, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.4.24, 5.1.0, 5.2.0 and 5.2.9, so stay on or above the fixed version for your major version. Run composer update symfony/security-core, then composer audit to confirm nothing else is flagged.

How do I check if my symfony/security-core version is affected?

Run composer show symfony/security-core in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.

Where this data comes from

Advisories come from the Packagist security advisories API, which collects the GitHub Advisory Database and the FriendsOfPHP security advisories. composer audit reads the same data. Releases come from packagist.org. Last synced 2026-11-03; we re-check daily. Each advisory links to its source. Spot an error? Tell us.

← All PHP packages