AIKIDO-2026-10888
symfony/monolog-bridge is vulnerable to Deserialization of Untrusted Data
81
High Risk
This Affects:
symfony/monolog-bridgeTL;DR
server:log listens on all interfaces by default and deserializes incoming log frames. Any host that can reach the listener can send attacker-controlled serialized PHP data without authentication. Pre-fix listeners can be crashed or exposed to object injection depending on available gadget classes. The fix binds to localhost by default and restricts deserialization to expected VarDumper classes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/monolog-bridge is vulnerable to Deserialization of Untrusted Data in versions 0.0.1 - 5.4.51, 6.0.0 - 6.4.39, 7.0.0 - 7.4.11 and 8.0.0 - 8.0.11.
How to fix this
Upgrade the symfony/monolog-bridge and/or symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant