composer

symfony/expression-language

Security advisories for symfony/expression-language, newest first. 1 known, all fixed. If you’re on 8.1.9 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.1.9

Advisories

1 · 0 unfixed

Last advisory

14 Oct 2026

Safe from

8.1.9

1 advisory · newest first

UNRATED 14 Oct 2026

CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process

PKSA-vq1j-sc3k-jzzk · CVE-2026-109449

Affected

≥ 2.4.0, < 5.4.54 ≥ 6.0.0, < 6.4.48 ≥ 7.0.0, < 7.4.21

and 1 more

≥ 8.0.0, < 8.1.9

Fixed in

5.4.54 6.4.48 7.4.21

and 1 more

8.1.9

Published

14 Oct 2026

/advisories/composer/symfony/expression-language/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

symfony/cache3 advisories symfony/dom-crawler1 advisory symfony/error-handler1 advisory symfony/http-client2 advisories symfony/http-foundation15 advisories symfony/http-kernel8 advisories symfony/mailer1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →