Skip to content

Commit 3aaacf4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-59f3-vp2f-mp9w GHSA-8v8v-g73j-492j
1 parent f6d9302 commit 3aaacf4

2 files changed

Lines changed: 262 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/05/GHSA-59f3-vp2f-mp9w/GHSA-59f3-vp2f-mp9w.json‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-59f3-vp2f-mp9w",
4+
"modified": "2026-05-28T17:33:47Z",
5+
"published": "2026-05-28T17:33:47Z",
6+
"aliases": [
7+
"CVE-2026-45755"
8+
],
9+
"summary": "Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection",
10+
"details": "### Description\n\nThe Mailtrap mailer bridge ships a webhook request parser used to authenticate and decode the event callbacks Mailtrap POSTs to an application's webhook endpoint. Its `doParse(Request $request, #[\\SensitiveParameter] string $secret)` method receives the configured webhook secret but never reads it; it decodes and returns the payload unconditionally, ignoring the `X-Mt-Signature` HMAC header Mailtrap sends with each request.\n\nAs a result, an application that wires up the Mailtrap webhook endpoint accepts **any** POST to that URL, even when a signing secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged event payloads, fake delivery / bounce / open / click / spam events, leading to suppression-list corruption, delivery-metrics fraud, etc.\n\n### Resolution\n\n`MailtrapRequestParser::doParse()` now requires and verifies the `X-Mt-Signature` header, an HMAC-SHA256 of the raw request body keyed with the configured secret, before decoding the payload, using a constant-time comparison.\n\nWhen no secret is configured the behaviour is unchanged: signature verification remains opt-in, but it is now actually enforced once opted in.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/4e0467e4e182cf2e704a3d9e1bc1a6be65d52ab8) for branch 7.4.\n\n### Credits\n\nSymfony would like to thank Himanshu Anand for reporting the issue and Alexandre Daubois providing the fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "symfony/mailtrap-mailer"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "7.2.0"
29+
},
30+
{
31+
"fixed": "7.4.12"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "symfony/mailtrap-mailer"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.0.0"
48+
},
49+
{
50+
"fixed": "8.0.12"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Packagist",
59+
"name": "symfony/symfony"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "7.2.0"
67+
},
68+
{
69+
"fixed": "7.4.12"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Packagist",
78+
"name": "symfony/symfony"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "8.0.0"
86+
},
87+
{
88+
"fixed": "8.0.12"
89+
}
90+
]
91+
}
92+
]
93+
}
94+
],
95+
"references": [
96+
{
97+
"type": "WEB",
98+
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-59f3-vp2f-mp9w"
99+
},
100+
{
101+
"type": "WEB",
102+
"url": "https://github.com/symfony/symfony/commit/4e0467e4e182cf2e704a3d9e1bc1a6be65d52ab8"
103+
},
104+
{
105+
"type": "WEB",
106+
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailtrap-mailer/CVE-2026-45755.yaml"
107+
},
108+
{
109+
"type": "WEB",
110+
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45755.yaml"
111+
},
112+
{
113+
"type": "PACKAGE",
114+
"url": "https://github.com/symfony/symfony"
115+
},
116+
{
117+
"type": "WEB",
118+
"url": "https://symfony.com/cve-2026-45755"
119+
}
120+
],
121+
"database_specific": {
122+
"cwe_ids": [
123+
"CWE-306",
124+
"CWE-347"
125+
],
126+
"severity": "MODERATE",
127+
"github_reviewed": true,
128+
"github_reviewed_at": "2026-05-28T17:33:47Z",
129+
"nvd_published_at": null
130+
}
131+
}

‎advisories/github-reviewed/2026/05/GHSA-8v8v-g73j-492j/GHSA-8v8v-g73j-492j.json‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8v8v-g73j-492j",
4+
"modified": "2026-05-28T17:34:55Z",
5+
"published": "2026-05-28T17:34:55Z",
6+
"aliases": [
7+
"CVE-2026-45756"
8+
],
9+
"summary": "Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS",
10+
"details": "### Description\n\nThe `JsonPath` component's `match()` and `search()` filter functions compile a caller-supplied pattern straight into `preg_match()`:\n\n```php\n'match' => @preg_match(\\sprintf('/^%s$/u', $this->transformJsonPathRegex($argList[1])), $value),\n'search' => @preg_match(\"/{$this->transformJsonPathRegex($argList[1])}/u\", $value),\n```\n\n`transformJsonPathRegex()` only performs cosmetic escaping: there is no length cap, no restriction to the RFC 9485 i-regexp subset, and no bound on backtracking. An application that evaluates an attacker-influenced JSONPath expression server-side (e.g. one taken from a query parameter or API field and passed to `JsonCrawler`) can therefore be made to run a catastrophic-backtracking pattern such as `$[?search(@, \"(a+)+$\")]`. Evaluated against a moderately sized document, this pins a CPU core for seconds per request, so a handful of concurrent requests exhausts the worker pool: a denial of service. Because the `preg_match()` calls are prefixed with `@`, the PCRE backtrack-limit errors that would otherwise surface are suppressed, leaving no log trace.\n\n### Conditions for exploitation\n\nAn application that evaluates an attacker-influenced JSONPath expression containing a `match()` / `search()` filter against any non-trivial JSON input.\n\n### Resolution\n\n`JsonCrawler` runs the `preg_match()` calls through a helper that lowers `pcre.backtrack_limit` to 10000 for the duration of the call (restoring the previous value afterwards), so a pathological pattern fails fast instead of stalling the worker.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/1ac2d47418ec23066112db1e6ca35be6fe123d14) for branch 7.4.\n\n### Credits\n\nSymfony would like to thank Himanshu Anand for reporting the issue and Alexandre Daubois for providing the fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "symfony/json-path"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "7.3.0"
29+
},
30+
{
31+
"fixed": "7.4.12"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "symfony/json-path"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.0.0"
48+
},
49+
{
50+
"fixed": "8.0.12"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Packagist",
59+
"name": "symfony/symfony"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "7.3.0"
67+
},
68+
{
69+
"fixed": "7.4.12"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Packagist",
78+
"name": "symfony/symfony"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "8.0.0"
86+
},
87+
{
88+
"fixed": "8.0.12"
89+
}
90+
]
91+
}
92+
]
93+
}
94+
],
95+
"references": [
96+
{
97+
"type": "WEB",
98+
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-8v8v-g73j-492j"
99+
},
100+
{
101+
"type": "WEB",
102+
"url": "https://github.com/symfony/symfony/commit/1ac2d47418ec23066112db1e6ca35be6fe123d14"
103+
},
104+
{
105+
"type": "WEB",
106+
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/json-path/CVE-2026-45756.yaml"
107+
},
108+
{
109+
"type": "WEB",
110+
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45756.yaml"
111+
},
112+
{
113+
"type": "PACKAGE",
114+
"url": "https://github.com/symfony/symfony"
115+
},
116+
{
117+
"type": "WEB",
118+
"url": "https://symfony.com/cve-2026-45756"
119+
}
120+
],
121+
"database_specific": {
122+
"cwe_ids": [
123+
"CWE-1333",
124+
"CWE-400"
125+
],
126+
"severity": "LOW",
127+
"github_reviewed": true,
128+
"github_reviewed_at": "2026-05-28T17:34:55Z",
129+
"nvd_published_at": null
130+
}
131+
}

0 commit comments

Comments
 (0)