symfony/dependency-injection

Allows you to standardize and centralize the way objects are constructed in your application

View on Packagist

View on Github

Activity

Latest release: 2d ago
Total releases: 702
Cadence: ~daily
Last 12 months: 71

Reach

Stars: 4.2k

Details

License: MIT
First release: Sep 29, 2011

Releases

Version	Released
`v8.1.10` patch	Oct 28, 2026
`v7.4.22` patch	Oct 25, 2026
`v6.4.49` patch	Oct 25, 2026
`v8.1.9` patch	Oct 13, 2026
`v7.4.21` patch	Oct 13, 2026
`v6.4.48` patch	Oct 13, 2026
`v8.1.8` patch	Sep 29, 2026
`v7.4.20` patch	Sep 29, 2026
`v6.4.47` patch	Sep 29, 2026
`v8.1.7` patch	Sep 11, 2026
`v8.1.5` patch	Aug 21, 2026
`v7.4.17` patch	Aug 21, 2026
`v6.4.44` patch	Aug 21, 2026
`v8.1.4` patch	Aug 07, 2026
`v7.4.16` patch	Aug 06, 2026
`v8.1.2` patch	Jul 28, 2026
`v8.0.15` patch	Jul 22, 2026
`v7.4.15` patch	Jul 22, 2026
`v6.4.43` patch	Jul 20, 2026
`v8.1.1` patch	Jun 27, 2026
`v8.0.14` patch	Jun 27, 2026
`v7.4.14` patch	Jun 24, 2026
`v6.4.42` patch	Jun 08, 2026
`v8.1.0` minor	May 29, 2026
`v8.1.0-RC1` pre	May 23, 2026
`v8.0.13` patch	May 23, 2026
`v7.4.13` patch	May 20, 2026
`v8.1.0-BETA3` pre	May 19, 2026
`v8.1.0-BETA1` pre	May 06, 2026
`v8.0.10` patch	May 06, 2026
`v7.4.10` patch	May 06, 2026
`v6.4.38` patch	May 04, 2026
`v8.0.9` patch	Apr 30, 2026
`v7.4.9` patch	Apr 30, 2026
`v6.4.37` patch	Apr 30, 2026
`v8.0.8` patch	Mar 31, 2026
`v7.4.8` patch	Mar 31, 2026
`v6.4.36` patch	Mar 30, 2026
`v8.0.7` patch	Mar 03, 2026
`v7.4.7` patch	Mar 03, 2026
`v6.4.35` patch	Feb 26, 2026
`v8.0.6` patch	Feb 25, 2026
`v7.4.6` patch	Feb 25, 2026
`v6.4.34` patch	Feb 24, 2026
`v8.0.5` patch	Jan 27, 2026
`v7.4.5` patch	Jan 27, 2026
`v7.3.11` patch	Jan 27, 2026
`v8.0.4` patch	Jan 23, 2026
`v7.4.4` patch	Jan 23, 2026
`v7.3.10` patch	Jan 23, 2026

1–50 of 702

Repository

symfony/dependency-injection

Forks: 92
Open issues: 0
Language: PHP
: 4.5/ 10

php
symfony
component
symfony-component

Dependencies (4)

Depends on

v8.1.10

Used by

7573

Supply-chain exposure

7,573 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

GHSA-c636-cg5r-2498 May 29, 2024

Symfony XML Entity Expansion security vulnerability

7.5 / 10
High
Network Low None None Unchanged None None High

Symfony 2.0.11 carried a [similar] XXE security fix, however, on review of ZF2 I also noted a vulnerability to XML Entity Expansion (XEE) attacks whereby all extensions making use of libxml2 have no defense against XEE Quadratic Blowup Attacks. The vulnerability is a function of there being no current method of disabling custom entities in PHP (i.e. defined internal to the XML document without using external entities). In a QBA, a long entity can be defined and then referred to multiple times in document elements, creating a memory sink with which Denial Of Service attacks against a host's RAM can be mounted. The use of the LIBXML_NOENT or equivalent option in a dependent extension amplified the impact (it doesn't actually mean "No Entities"). In addition, libxml2's innate defense against the related Exponential or Billion Laugh's XEE attacks is active only so long as the LIBXML_PARSEHUGE is NOT set (it disables libxml2's hardcoded entity recursion limit). No instances of these two options were noted, but it's worth referencing for the future.

Consider this (non-fatal) example:

<?xml version="1.0"?> <!DOCTYPE data [<!ENTITY a "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa">]> <data>&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;</data>

Increase the length of entity, and entity count to a few hundred, and peak memory usage will waste no time spiking the moment the nodeValue for is accessed since the entities will then be expanded by a simple multiplier effect. No external entities required.

...

This can be used in combination with the usual XXE defense of calling libxml_disable_entity_loader(TRUE) and, optionally, the LIBXML_NONET option (should local filesystem access be allowable). The DOCTYPE may be removed instead of rejecting the XML outright but this would likely result in other problems with the unresolved entities.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.9

Fixed in

2.0.17

References

https://github.com/symfony/dependency-injection/commit/5c5040c890a8e4085dcd6fa3827f574ab5f71f4c
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/2012-08-28.yaml
https://github.com/symfony/dependency-injection
https://symfony.com/blog/security-release-symfony-2-0-17-released

Updated Dec 04, 2024 · Source: OSV.dev
CVE-2019-10910 GHSA-pgwj-prpq-jpc2 Nov 18, 2019

Symfony Service IDs Allow Injection

9.8 / 10
Critical
Network Low None None Unchanged High High High

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

Affected versions

v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19

+ 221 more Show less

v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.17v3.3.18v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-BETA1v3.4.0-BETA2v3.4.0-BETA3v3.4.0-BETA4v3.4.0-RC1v3.4.0-RC2v3.4.1v3.4.10v3.4.11v3.4.12v3.4.13v3.4.14v3.4.15v3.4.16v3.4.17v3.4.18v3.4.19v3.4.2v3.4.20v3.4.21v3.4.22v3.4.23v3.4.24v3.4.25v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6

Fixed in

2.7.512.8.503.4.264.1.124.2.7

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10910
https://github.com/symfony/symfony/commit/3876c75f858d5d82e2c309698d21af2f1d721afb
https://github.com/symfony/symfony/commit/4c80c3444854ef384df94deb4acbcef4b5e5243b
https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml

Updated May 29, 2025 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 6
minor 29
patch 571
pre 95

702 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More