Every CVE Search/ Get API key

CVE-2016-1902

Symfony Cryptographic Vulnerability

7.5 HighFix available

CVE-2016-1902 is a high vulnerability (CVSS 7.5) in Sensiolabs Symfony, published May 29, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in symfony/security-core 2.6.13.

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.91%Up 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Record
CVE-2016-1902
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Record
CVE-2016-1902
Updated
2026-11-02
EUVDEUVD-2022-4395 No score

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Record
EUVD-2022-4395
Updated
2026-11-03
GitHub AdvisoriesGHSA-jjx5-fq5g-8xpc 7.5

Symfony Cryptographic Vulnerability

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Record
GHSA-jjx5-fq5g-8xpc
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-332
Updated
2026-11-02
OSV 7.5

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Record
CVE-2016-1902
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2016-1902 7.5

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Record
DEBIAN-CVE-2016-1902
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-jjx5-fq5g-8xpc 7.5

Symfony Cryptographic Vulnerability

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Record
GHSA-jjx5-fq5g-8xpc
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-332
Updated
2026-11-02
OSVUBUNTU-CVE-2016-1902 7.5

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Record
UBUNTU-CVE-2016-1902
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/security-core
Packagist
 2.4.0 up to 2.6.13
2.6.13
symfony/security-core
Packagist
 2.7.0 up to 2.7.9
2.7.9
symfony/security
Packagist
 2.3.0 up to 2.3.37
2.3.37
symfony/security
Packagist
 2.4.0 up to 2.6.13
2.6.13
symfony/security
Packagist
 2.7.0 up to 2.7.9
2.7.9
symfony/symfony
Packagist
 2.3.0 up to 2.3.37
2.3.37
symfony/symfony
Packagist
 2.4.0 up to 2.6.13
2.6.13
symfony/symfony
Packagist
 2.7.0 up to 2.7.9
2.7.9
symfony
Debian:12
 before 2.7.9+dfsg-1
2.7.9+dfsg-1
symfony
Debian:13
 before 2.7.9+dfsg-1
2.7.9+dfsg-1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
symfony
Debian:14
 before 2.7.9+dfsg-1
2.7.9+dfsg-1
symfony
Debian:8
 before 2.3.21+dfsg-4+deb8u3, plus listed versions
2.3.21+dfsg-42.3.21+dfsg-4+deb8u12.3.21+dfsg-4+deb8u2
2.3.21+dfsg-4+deb8u3
symfony/security-core
Packagist
 2.4.0 up to 2.6.13, plus listed versions
v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3
Show 37 moreShow less
v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.12v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9
2.6.13
symfony/security-core
Packagist
 2.7.0 up to 2.7.9, plus listed versions
v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4
Show 4 moreShow less
v2.7.5v2.7.6v2.7.7v2.7.8
2.7.9
symfony/security
Packagist
 2.3.0 up to 2.3.37, plus listed versions
v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12
Show 32 moreShow less
v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9
2.3.37
symfony/security
Packagist
 2.4.0 up to 2.6.13, plus listed versions
v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3
Show 37 moreShow less
v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.12v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9
2.6.13
symfony/security
Packagist
 2.7.0 up to 2.7.9, plus listed versions
v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4
Show 4 moreShow less
v2.7.5v2.7.6v2.7.7v2.7.8
2.7.9
symfony/symfony
Packagist
 2.3.0 up to 2.3.37, plus listed versions
v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12
Show 32 moreShow less
v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9
2.3.37
symfony/symfony
Packagist
 2.4.0 up to 2.6.13, plus listed versions
v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3
Show 37 moreShow less
v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.12v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9
2.6.13
symfony/symfony
Packagist
 2.7.0 up to 2.7.9, plus listed versions
v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4
Show 4 moreShow less
v2.7.5v2.7.6v2.7.7v2.7.8
2.7.9

History

History
WhenChangedSources
2026-11-03affected
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open