CVE-2026-45077: Symfony MonologBridge PHP deserialization in server:log listener

CVE-2026-45077 · Severity: high · CVSS 4 · Published 2026-07-14

Symfony is a popular PHP framework used to build web applications. A vulnerability in its logging component could allow an attacker to crash the logging service or potentially execute unauthorized code by sending specially crafted data to a network port that is open by default. This could lead to service disruptions or a compromise of the server's security.

Technologies: symfony/symfony (Packagist). Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-45077 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45077 being exploited in the wild.
How severe is CVE-2026-45077?
High severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/monolog-bridge (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; symfony/symfony (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; Symfony Monolog Bridge < 5.4.52, >= 6.0.0 < 6.4.40, >= 7.0.0 < 7.4.12, >= 8.0.0 < 8.0.12, < 5.4.52, >= 6.0.0-BETA1 < 6.4.40, >= 7.0.0-BETA1 < 7.4.12, >= 8.0.0-BETA1 < 8.0.12.
Is there a fix for CVE-2026-45077?
Yes. symfony/monolog-bridge (Packagist): upgrade to 5.4.52 or later; symfony/symfony (Packagist): upgrade to 5.4.52 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45077 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45077?
Check whether you run symfony/monolog-bridge (Packagist), symfony/symfony (Packagist) or Symfony Monolog Bridge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/monolog-bridge (Packagist): upgrade to 5.4.52 or later
    composer require symfony/monolog-bridge:^5.4.52
  • symfony/symfony (Packagist): upgrade to 5.4.52 or later
    composer require symfony/symfony:^5.4.52

Technical details

A deserialization of untrusted data vulnerability exists in the Symfony MonologBridge component. The 'server:log' listener (ServerLogCommand) binds to 0.0.0.0:9911 by default and processes incoming messages using 'unserialize(base64_decode($message))' without authentication, integrity checks, or class allowlisting. A remote attacker can send malicious PHP serialized payloads to this port to crash the listener or trigger object-injection gadget chains, potentially leading to remote code execution. The fix changes the default binding to localhost and implements safer handling. Patches are available in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Affected products

  • symfony symfony < 5.4.52, >= 6.0.0-BETA1 < 6.4.40, >= 7.0.0-BETA1 < 7.4.12, >= 8.0.0-BETA1 < 8.0.12
  • symfony monolog-bridge < 5.4.52, >= 6.0.0-BETA1 < 6.4.40, >= 7.0.0-BETA1 < 7.4.12, >= 8.0.0-BETA1 < 8.0.12

Identifiers

  • CVE-2026-45077
  • GHSA-m7v2-7gxm-vc2v

Timeline

  • 2026-07-14: disclosed
  • 2026-07-14: advisory
  • 2026-05-20: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.