CVE-2026-46626: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade composer/symfony/symfony to a version that resolves this vulnerability.

   Fixed in 5.4.52
2. Upgrade

   Upgrade composer/symfony/symfony to a version that resolves this vulnerability.

   Fixed in 6.4.40
3. Upgrade

   Upgrade composer/symfony/symfony to a version that resolves this vulnerability.

   Fixed in 7.4.12
4. Upgrade

   Upgrade composer/symfony/symfony to a version that resolves this vulnerability.

   Fixed in 8.0.12
5. Upgrade

   Upgrade composer/symfony/runtime to a version that resolves this vulnerability.

   Fixed in 5.4.52
6. Upgrade

   Upgrade composer/symfony/runtime to a version that resolves this vulnerability.

   Fixed in 6.4.40
7. Upgrade

   Upgrade composer/symfony/runtime to a version that resolves this vulnerability.

   Fixed in 7.4.12
8. Upgrade

   Upgrade composer/symfony/runtime to a version that resolves this vulnerability.

   Fixed in 8.0.12
9. Upgrade

   Upgrade debian/symfony to a version that resolves this vulnerability.

   Fixed in 5.4.53+dfsg-0+deb12u1Fixed in 6.4.41+dfsg-0+deb13u1Fixed in 6.4.49+dfsg-0+deb13u1Fixed in 7.4.22+dfsg-1Fixed in 7.4.23+dfsg-1

Event History

Parent advisories

This vulnerability appears in the following advisories.

• DSA-6312
• DSA-6317