CVE-2026-45077 Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
Unauthenticated PHP object deserialization in Symfony Monolog Bridge allows remote attackers to execute code or cause denial of service via crafted serialized payloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45077?
CVE-2026-45077 is a high-severity unsafe deserialization vulnerability in Sensiolabs Symfony, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Which versions are affected by CVE-2026-45077?
16 open source packages ship an affected version, including symfony/monolog-bridge and symfony/symfony. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/monolog-bridge Packagist | All versions | 5.4.52 |
symfony/monolog-bridge Packagist | All versions | 5.4.52 |
symfony/monolog-bridge Packagist | From 6.0.0 | 6.4.40 |
symfony/monolog-bridge Packagist | From 6.0.0 | 6.4.40 |
symfony/monolog-bridge Packagist | From 7.0.0 | 7.4.12 |
symfony/monolog-bridge Packagist | From 7.0.0 | 7.4.12 |
10 more packages
symfony/monolog-bridge Packagist | From 8.0.0 | 8.0.12 |
symfony/monolog-bridge Packagist | From 8.0.0 | 8.0.12 |
symfony/symfony Packagist | All versions | 5.4.52 |
symfony/symfony Packagist | All versions | 5.4.52 |
symfony/symfony Packagist | From 6.0.0 | 6.4.40 |
symfony/symfony Packagist | From 6.0.0 | 6.4.40 |
symfony/symfony Packagist | From 7.0.0 | 7.4.12 |
symfony/symfony Packagist | From 7.0.0 | 7.4.12 |
symfony/symfony Packagist | From 8.0.0 | 8.0.12 |
symfony/symfony Packagist | From 8.0.0 | 8.0.12 |
Products include Sensiolabs Symfony.
How do I fix CVE-2026-45077?
Upgrade symfony/monolog-bridge to a fixed version for your release line: 5.4.52, 6.4.40, 7.4.12 or 8.0.12.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-45077 being exploited?
There is no known exploitation of CVE-2026-45077 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
Sources
Also known as DEBIAN-CVE-2026-45077, GHSA-m7v2-7gxm-vc2v, UBUNTU-CVE-2026-45077.