-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 04 Nov 2026 16:33:54 +0100
Source: symfony
Architecture: source
Version: 6.4.50+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
 symfony (6.4.50+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Fabien Potencier ]
   * Update VERSION for 6.4.50
 .
   [ Nicolas Grekas ]
   * [Config] Do not validate XML documents on parse
     (GHSA-5jff-8h8q-r5qx) [CVE-2026-123824]
   * [HtmlSanitizer] Fix meta refresh URL sanitization bypass
     (GHSA-wm2w-4mgj-vw33) [CVE-2026-121373]
   * [Validator] Reject non-public IP addresses in the no-priv, no-res
     and only-public modes (GHSA-4qpf-57w4-m3wc) [CVE-2026-123125]
   * [HtmlSanitizer] Require special schemes and scheme-relative URLs to
     carry a non-empty authority [CVE-2026-118517]
   * [HttpClient] Don't send the options of the default scope to other
     origins in ScopingHttpClient (GHSA-gq53-v8w2-gjhj) [CVE-2026-121971]
   * [Security] Run the checkPostAuth() method of user checkers when
     authenticating users programmatically
     (GHSA-8f57-m8wj-x65w) [CVE-2026-123746]
   * [HttpClient] Pin the IP of cached hosts in NoPrivateNetworkHttpClient
     (GHSA-c7hm-wqwp-f9v8) [CVE-2026-123119]
   * [Serializer] Lowercase the scheme of data URIs before opening them
     (GHSA-pxj9-jh84-vhm5) [CVE-2026-121623]
   * [Security] Parse the DN into RDNs before extracting the user identifier
     [CVE-2026-118513]
   * [Serializer] Don't build UploadedFile and other file objects from
     denormalized data [CVE-2026-118515]
   * [HtmlSanitizer] Apply the URL policy to srcset and imagesrcset
     (GHSA-q8jq-xrf4-v5j8) [CVE-2026-121949]
   * [HttpFoundation] Add the list of private ranges usable as trusted proxies
     (GHSA-xg2q-4rrq-657q)
   * [HttpKernel] Restore the router context of the parent request after a
     sub-request (GHSA-wg5q-m2ww-f3c9)
   * [Routing] Prevent host placeholders from matching the path in compiled
     matchers [CVE-2026-118516]
   * [Filesystem] Only treat a valid URI scheme as the root of a path
     (GHSA-6prc-h956-hxjq)
   * [Yaml] Fix exponential and quadratic parse times
     (GHSA-hwfg-qwvh-2wfx) [CVE-2026-123792]
   * [Serializer] Ignore undeclared property paths when denormalizing
     (GHSA-hqp2-7rr8-hf26) [CVE-2026-122053]
   * [HttpFoundation] Match HEAD requests when GET is listed in a RequestMatcher
     [CVE-2026-118514]
   * [HttpFoundation] Don't let Request::getBaseUrl() start with a host chosen by
     the client (GHSA-5mx8-mwrp-5693)
 .
   [ Jack Worman ]
   * [HttpFoundation] Don't match the script name in Request::getBaseUrl() when
     it's only the start of a path segment (GHSA-3h27-hjv7-fqjx)
 .
   [ David Prévot ]
   * Refresh patches
Checksums-Sha1:
 e93bad453d545dc043524923823bcd8d2e8e0b26 16771 symfony_6.4.50+dfsg-0+deb13u1.dsc
 89aaaadd1b0b725b0aef6dd0412d387ebfa23eaa 9721868 symfony_6.4.50+dfsg.orig.tar.xz
 4026f6ed502d898381d344f134037d22e8d20d4b 86532 symfony_6.4.50+dfsg-0+deb13u1.debian.tar.xz
 e0cd4fae6dfb3e0eb624ca88b513038c4236cb43 71991 symfony_6.4.50+dfsg-0+deb13u1_amd64.buildinfo
Checksums-Sha256:
 d55f39e38a4a742179a4ff40ca528c1b4f032553c74877456e949a139011cf88 16771 symfony_6.4.50+dfsg-0+deb13u1.dsc
 97b3eba304b890ae3803b160a3fa93761a5607482a326d8e4a87c82d7c250f86 9721868 symfony_6.4.50+dfsg.orig.tar.xz
 af965168fcd5a4504a13299075ec58f86d39a347972587e8fc6d1a4d589c65be 86532 symfony_6.4.50+dfsg-0+deb13u1.debian.tar.xz
 009a8721ffe39828b667d95d3ae3d3253fcdc6b39e572113ae0d9ebd7d3f0066 71991 symfony_6.4.50+dfsg-0+deb13u1_amd64.buildinfo
Files:
 11e0f0a203637780dd2c4f27d6b5bd9e 16771 php optional symfony_6.4.50+dfsg-0+deb13u1.dsc
 76b3d45a5b0c66a1a1496ffc908a80b4 9721868 php optional symfony_6.4.50+dfsg.orig.tar.xz
 819ecbdfb2fd9921c82ee340d8fcdc1c 86532 php optional symfony_6.4.50+dfsg-0+deb13u1.debian.tar.xz
 0fe7e6a5856223928a17a6aecb40440b 71991 php optional symfony_6.4.50+dfsg-0+deb13u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmrwNkcSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08tBkIAI8UfRJUmhIr4+3fhbnb7bimsk3E3znx
uGJa0Hc+razmEL0x63G7eJLHZBtL6h7sNUdaTnIKIRnXBBDiDh4e/SA16wxEPYBI
RP9ZydwTYOcPVfv9HEQJj/xYB7BApR63xKrswF6aWEcxD6OMbCXUuQUGUSdpr/DZ
sMbK/M++uiT26hltvUdd1HviTFGRIYquVt7H5F1BWtNrCLl8TsUklxUapzkq8+C9
TtngyaxnpzNzXBC6YW/qg23X+Y6/QfmebLBpfuHV0HLgbiC8uUcyfwwsnT0ZgJdU
louJI8nAva2vjG079UdMHfREHhyx2J53LCR2T6E2fNU4ys1g9pFoPgM=
=YYVl
-----END PGP SIGNATURE-----