CVE-2016-4423: High severity symfony vulnerability
CVE-2016-4423: Large username storage in session
Other sources
The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.
— GitHub
The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4423?
CVE-2016-4423 is classified as a moderate severity vulnerability.
How do I fix CVE-2016-4423?
To fix CVE-2016-4423, upgrade Symfony to version 2.3.41, 2.7.13, 2.8.6, or 3.0.6 or later.
Which Symfony versions are affected by CVE-2016-4423?
CVE-2016-4423 affects Symfony versions prior to 2.3.41, 2.7.13, 2.8.6, and 3.0.6.
What type of vulnerability is CVE-2016-4423?
CVE-2016-4423 is a vulnerability related to large username storage in session management.
Is CVE-2016-4423 being actively exploited?
There is no public evidence that CVE-2016-4423 is currently being actively exploited.