CVE-2019-18889 — Vulnerability in symfony/symfony — CVE Details
Symfony Unsafe Cache Serialization Could Enable RCE
Summary
Advisory Timeline
- First published December 2, 2019 (2506 days ago).
- Last revised February 20, 2024 — 1540 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
composer require "symfony/symfony:^3.4.35"
composer require "symfony/cache:^4.2.12"
composer require "symfony/cache:^3.4.35"
composer require "symfony/cache:^4.3.8"
composer require "symfony/symfony:^4.2.12"
composer require "symfony/symfony:^4.3.8"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (6)
Affects 1 ecosystem: packagist (2).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| symfony/symfony | packagist | v3.1.0, v3.1.1, v3.1.10, v3.1.2 (+87 more) | 3.4.35 |
| symfony/cache | packagist | v4.0.0, v4.0.1, v4.0.10, v4.0.11 (+43 more) | 4.2.12 |
| symfony/cache | packagist | v3.1.0, v3.1.1, v3.1.10, v3.1.2 (+87 more) | 3.4.35 |
| symfony/cache | packagist | v4.3.0, v4.3.1, v4.3.2, v4.3.3 (+4 more) | 4.3.8 |
| symfony/symfony | packagist | v4.0.0, v4.0.1, v4.0.10, v4.0.11 (+44 more) | 4.2.12 |
| symfony/symfony | packagist | v4.3.0, v4.3.1, v4.3.2, v4.3.3 (+4 more) | 4.3.8 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-94Code InjectionMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-18889ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-18889.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18889.yamlWEB
- https://github.com/symfony/symfony/releases/tag/v4.3.8WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EAWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EAWEB
- https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instancesWEB
- https://symfony.com/blog/symfony-4-3-8-releasedWEB
- https://symfony.com/cve-2019-18889WEB
Frequently Asked Questions
- What is CVE-2019-18889?
- Symfony Unsafe Cache Serialization Could Enable RCE This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2019-18889?
- CVE-2019-18889 affects symfony/symfony and symfony/cache. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-18889 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2018-11407CRITICAL
Symfony Authentication Bypass
- CVE-2025-64500HIGH
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
- CVE-2026-45075HIGH
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
- CVE-2018-11406HIGH
Symfony CSRF Token Fixation
- CVE-2026-45754MEDIUM
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
- CVE-2026-45073MEDIUM
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
- CVE-2026-47767MEDIUM
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
- CVE-2026-48784MEDIUM
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies