CVE-2018-11386
Symfony DoS
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
- Record
CVE-2018-11386- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-613
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
- Record
CVE-2018-11386- Updated
- 2026-11-02
EUVDEUVD-2022-5068 No score
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
- Record
EUVD-2022-5068- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r2rq-3h56-fqm4
Symfony DoS
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
- Record
GHSA-r2rq-3h56-fqm4- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSV
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
- Record
CVE-2018-11386- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11386
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
- Record
DEBIAN-CVE-2018-11386- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-r2rq-3h56-fqm4
Symfony DoS
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
- Record
GHSA-r2rq-3h56-fqm4- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11386
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
- Record
UBUNTU-CVE-2018-11386- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/symfonyPackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/symfonyPackagist |
3.3.0 up to 3.3.17 | 3.3.17 |
symfony/symfonyPackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/symfonyPackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
symfony/http-foundationPackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/http-foundationPackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/http-foundationPackagist |
3.3.0 up to 3.3.17 | 3.3.17 |
symfony/http-foundationPackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/http-foundationPackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfonyDebian:12 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:13 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:14 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:9 From an advisory covering 8 CVEs |
before 2.8.7+dfsg-1.3+deb9u1, plus listed versions 2.8.7+dfsg-1.3 |
2.8.7+dfsg-1.3+deb9u1 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/symfonyPackagist |
3.3.0 up to 3.3.17, plus listed versions v3.3.0v3.3.1v3.3.10v3.3.11v3.3.12 Show 12 moreShow lessv3.3.13v3.3.14v3.3.15v3.3.16v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9 |
3.3.17 |
symfony/symfonyPackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/symfonyPackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfony/http-foundationPackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/http-foundationPackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/http-foundationPackagist |
3.3.0 up to 3.3.17, plus listed versions v3.3.0v3.3.1v3.3.10v3.3.11v3.3.12 Show 12 moreShow lessv3.3.13v3.3.14v3.3.15v3.3.16v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9 |
3.3.17 |
symfony/http-foundationPackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/http-foundationPackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfonyUbuntu:18.04:LTS |
before 3.4.6+dfsg-1ubuntu0.1, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-1 |
3.4.6+dfsg-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11386 is a medium vulnerability (CVSS 5.9) in Sensiolabs Symfony, published June 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.58%, the 75th percentile. Fixed in symfony/symfony 2.7.48.
References
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler
debian.org/security/2018/dsa-4262
nvd.nist.gov/vuln/detail/CVE-2018-11386
Show 11 moreShow less
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml
security-tracker.debian.org/tracker/CVE-2018-11386
ubuntu.com/security/CVE-2018-11386
cve.org/CVERecord?id=CVE-2018-11386