CVE-2026-45077: Sensiolabs Symfony RCE Vulnerability

CVE-2026-45077 Overview

CVE-2026-45077 is an insecure deserialization vulnerability [CWE-502] in the Symfony PHP framework's Monolog Bridge component. The server:log listener implemented in Symfony\Bridge\Monolog\Command\ServerLogCommand binds to 0.0.0.0:9911 by default and processes incoming frames using unserialize(base64_decode($message)). The listener performs no authentication, no integrity validation, and does not restrict allowed_classes. Any host that can reach the port can submit crafted serialized PHP payloads to crash the listener or trigger PHP object-injection gadget chains. The issue is fixed in Symfony 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
Unauthenticated network attackers can send serialized PHP payloads to the Symfony server:log listener, causing denial of service and potentially triggering object-injection gadget chains on developer or CI hosts.

Affected Products

Symfony < 5.4.52
Symfony 6.x < 6.4.40 and 7.x < 7.4.12
Symfony 8.x < 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45077 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45077

Vulnerability Analysis

The server:log command in the Symfony Monolog Bridge starts a listener intended to receive log frames from a Symfony application during local development. The command binds to 0.0.0.0:9911 by default, exposing the port to every network interface rather than restricting it to 127.0.0.1. Each frame is base64-decoded and passed directly to PHP's unserialize() without an allowed_classes allowlist. The listener also skips message authentication and integrity checks. An attacker with network reachability to the port can submit arbitrary serialized objects, driving the PHP object graph reconstruction into any class autoloadable by the target application.

Root Cause

The root cause is unsafe use of unserialize() on untrusted input combined with an over-permissive default network bind. ServerLogHandler encodes records with base64_encode(serialize($recordFormatted)), and the receiving side reverses that operation with no guard. Because unserialize() invokes magic methods such as __wakeup, __destruct, and __toString, any autoloaded class with an exploitable gadget can be reached during reconstruction, matching the CWE-502 pattern.

Attack Vector

The attack requires network access to TCP port 9911 on a host running bin/console server:log. The attacker sends a single UDP or TCP frame containing a base64-encoded serialized PHP object. Minimum outcomes are listener process crashes and log-pipeline denial of service. When a suitable gadget chain is loaded by the application's autoloader, deserialization can produce further side effects, including file operations or command execution depending on the classes available.

php

// Security patch in ServerLogCommand.php
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 use Symfony\Component\ExpressionLanguage\ExpressionLanguage;
+use Symfony\Component\VarDumper\Cloner\Data;
+use Symfony\Component\VarDumper\Cloner\Stub;
 
 /**
  * @author Grégoire Pineau <lyrixx@lyrixx.info>

Source: Symfony commit 0891b2f. The upstream fix binds server:log to localhost by default and hardens frame handling in ServerLogHandler.

Detection Methods for CVE-2026-45077

Indicators of Compromise

Inbound TCP or UDP traffic to port 9911 from hosts outside the loopback interface.
php or symfony console processes running server:log that terminate unexpectedly or restart in tight loops.
Unexpected files, outbound connections, or command execution originating from the PHP process that hosts the server:log listener.

Detection Strategies

Inventory hosts running bin/console server:log or symfony server:log and confirm which interface the process is bound to using ss -ltnp | grep 9911.
Alert on any process invoking unserialize() on network-sourced buffers within Symfony's Monolog Bridge on non-development environments.
Correlate crash events of PHP CLI workers with recent inbound frames on port 9911.

Monitoring Recommendations

Log all listeners on 0.0.0.0:9911 and route the events to a centralized SIEM for review.
Monitor egress from developer workstations and CI runners that execute Symfony console commands, since these are the most likely deployment contexts for the listener.
Track Symfony framework versions across repositories and build agents to flag components still on < 5.4.52, < 6.4.40, < 7.4.12, or < 8.0.12.

How to Mitigate CVE-2026-45077

Immediate Actions Required

Upgrade Symfony to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Stop any server:log process reachable from non-loopback interfaces until the upgrade is applied.
Block inbound traffic to TCP/UDP port 9911 at the host firewall on developer and CI systems.

Patch Information

The fix is delivered in commit 0891b2f293896c488e26943dc034334364b77fc4 and shipped in Symfony v5.4.52, v6.4.40, v7.4.12, and v8.0.12. The advisory is published as GHSA-m7v2-7gxm-vc2v. The patch changes the default bind address to localhost and normalizes datetime handling in ServerLogHandler.

Workarounds

Pass an explicit 127.0.0.1:9911 host argument when running server:log to avoid the wildcard bind.
Restrict port 9911 to loopback with a host firewall rule until upgrading is possible.
Ensure the server:log command is never executed in production or on internet-exposed hosts.

bash

# Bind server:log to loopback only and block external access
php bin/console server:log 127.0.0.1:9911

# Linux iptables example to restrict port 9911 to localhost
iptables -A INPUT -p tcp --dport 9911 ! -i lo -j DROP
iptables -A INPUT -p udp --dport 9911 ! -i lo -j DROP