symfony/validator

Provides tools to validate values

View on Packagist

View on Github

Activity

Latest release: 5d ago
Total releases: 697
Cadence: ~daily
Last 12 months: 68

Reach

Stars: 2.7k

Details

License: MIT
First release: Sep 29, 2011

Releases

Version	Released
`v8.1.7` patch	Sep 09, 2026
`v7.4.19` patch	Sep 09, 2026
`v6.4.46` patch	Sep 09, 2026
`v8.1.6` patch	Aug 30, 2026
`v7.4.18` patch	Aug 30, 2026
`v6.4.45` patch	Aug 30, 2026
`v8.1.5` patch	Aug 22, 2026
`v7.4.17` patch	Aug 22, 2026
`v6.4.44` patch	Aug 21, 2026
`v8.1.4` patch	Aug 06, 2026
`v7.4.16` patch	Aug 06, 2026
`v8.1.2` patch	Jul 28, 2026
`v8.0.15` patch	Jul 28, 2026
`v7.4.15` patch	Jul 28, 2026
`v6.4.43` patch	Jul 28, 2026
`v8.1.1` patch	Jun 27, 2026
`v8.0.14` patch	Jun 27, 2026
`v7.4.14` patch	Jun 27, 2026
`v6.4.42` patch	Jun 26, 2026
`v8.1.0` minor	May 29, 2026
`v8.1.0-RC1` pre	May 20, 2026
`v8.1.0-BETA3` pre	May 18, 2026
`v8.1.0-BETA2` pre	May 07, 2026
`v8.1.0-BETA1` pre	May 05, 2026
`v8.0.10` patch	May 05, 2026
`v7.4.10` patch	May 05, 2026
`v8.0.9` patch	Apr 30, 2026
`v7.4.9` patch	Apr 30, 2026
`v6.4.37` patch	Apr 29, 2026
`v8.0.8` patch	Mar 30, 2026
`v7.4.8` patch	Mar 30, 2026
`v6.4.36` patch	Mar 26, 2026
`v8.0.7` patch	Mar 06, 2026
`v7.4.7` patch	Mar 06, 2026
`v6.4.35` patch	Mar 02, 2026
`v8.0.6` patch	Feb 25, 2026
`v7.4.6` patch	Feb 25, 2026
`v6.4.34` patch	Feb 23, 2026
`v8.0.5` patch	Jan 27, 2026
`v7.4.5` patch	Jan 27, 2026
`v7.3.11` patch	Jan 27, 2026
`v6.4.33` patch	Jan 26, 2026
`v8.0.4` patch	Jan 08, 2026
`v7.4.4` patch	Jan 08, 2026
`v7.3.10` patch	Jan 08, 2026
`v8.0.3` patch	Dec 27, 2025
`v7.4.3` patch	Dec 27, 2025
`v7.3.9` patch	Dec 27, 2025
`v6.4.31` patch	Dec 24, 2025
`v8.0.2` patch	Dec 08, 2025

1–50 of 697

Repository

symfony/validator

Forks: 106
Open issues: 0
Language: PHP
: 4.5/ 10

php
symfony
component
symfony-component

Dependencies (4)

Depends on

v8.1.7

Used by

2786

Supply-chain exposure

2,786 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (3)

CVE-2024-50343 GHSA-g3rh-rrhp-jhh9 Nov 06, 2024

Symfony has an incorrect response from Validator when input ends with `\n`

Low
Network Low Low None

Description

It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n.

Resolution

Symfony now uses the D regex modifier to match the entire input.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 651 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.37v2.3.38v2.3.39v2.3.4v2.3.40v2.3.41v2.3.42v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-BETA1v2.4.0-BETA2v2.4.0-RC1v2.4.1v2.4.10v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.12v2.6.13v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-BETA1v2.7.0-BETA2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.51v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.0-BETA1v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.52v2.8.6v2.8.7v2.8.8v2.8.9v3.0.0v3.0.0-BETA1v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.17v3.3.18v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-BETA1v3.4.0-BETA2v3.4.0-BETA3v3.4.0-BETA4v3.4.0-RC1v3.4.0-RC2v3.4.1v3.4.10v3.4.11v3.4.12v3.4.13v3.4.14v3.4.15v3.4.16v3.4.17v3.4.18v3.4.19v3.4.2v3.4.20v3.4.21v3.4.22v3.4.23v3.4.24v3.4.25v3.4.26v3.4.27v3.4.28v3.4.29v3.4.3v3.4.30v3.4.31v3.4.32v3.4.33v3.4.34v3.4.35v3.4.36v3.4.37v3.4.38v3.4.39v3.4.4v3.4.40v3.4.41v3.4.42v3.4.43v3.4.44v3.4.45v3.4.46v3.4.47v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.0-BETA1v4.0.0-BETA2v4.0.0-BETA3v4.0.0-BETA4v4.0.0-RC1v4.0.0-RC2v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1v4.3.0-BETA2v4.3.0-RC1v4.3.1v4.3.10v4.3.11v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.21v4.4.22v4.4.24v4.4.25v4.4.26v4.4.27v4.4.29v4.4.3v4.4.30v4.4.31v4.4.33v4.4.34v4.4.35v4.4.36v4.4.37v4.4.38v4.4.39v4.4.4v4.4.40v4.4.41v4.4.43v4.4.44v4.4.45v4.4.46v4.4.47v4.4.48v4.4.5v4.4.6v4.4.7v4.4.8v4.4.9v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.1v5.0.10v5.0.11v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.10v5.2.11v5.2.12v5.2.14v5.2.2v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.9v5.3.0v5.3.0-BETA1v5.3.0-RC1v5.3.1v5.3.10v5.3.11v5.3.12v5.3.13v5.3.14v5.3.2v5.3.3v5.3.4v5.3.6v5.3.7v5.3.8v5.4.0v5.4.0-BETA1v5.4.0-BETA2v5.4.0-BETA3v5.4.0-RC1v5.4.1v5.4.10v5.4.11v5.4.12v5.4.13v5.4.14v5.4.15v5.4.17v5.4.19v5.4.2v5.4.21v5.4.22v5.4.23v5.4.24v5.4.25v5.4.26v5.4.28v5.4.29v5.4.3v5.4.30v5.4.31v5.4.32v5.4.34v5.4.35v5.4.36v5.4.38v5.4.39v5.4.40v5.4.41v5.4.42v5.4.5v5.4.6v5.4.7v5.4.8v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12v6.0.13v6.0.14v6.0.15v6.0.17v6.0.19v6.0.2v6.0.3v6.0.5v6.0.6v6.0.7v6.0.8v6.1.0v6.1.0-BETA1v6.1.0-RC1v6.1.1v6.1.11v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA2v6.2.0-BETA3v6.2.0-RC1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.3v6.2.5v6.2.7v6.2.8v6.3.0v6.3.0-BETA1v6.3.0-RC1v6.3.0-RC2v6.3.1v6.3.11v6.3.12v6.3.2v6.3.4v6.3.5v6.3.6v6.3.7v6.3.8v6.3.9v6.4.0v6.4.0-BETA1v6.4.0-BETA2v6.4.0-BETA3v6.4.0-RC1v6.4.0-RC2v6.4.10v6.4.2v6.4.3v6.4.4v6.4.6v6.4.7v6.4.8v6.4.9v7.0.0v7.0.10v7.0.2v7.0.3v7.0.4v7.0.5v7.0.6v7.0.7v7.0.8v7.0.9v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.2v7.1.3

Fixed in

5.4.436.4.117.1.4

References

https://github.com/symfony/symfony/security/advisories/GHSA-g3rh-rrhp-jhh9
https://nvd.nist.gov/vuln/detail/CVE-2024-50343
https://github.com/symfony/symfony/commit/7d1032bbead9a4229b32fa6ebca32681c80cb76f
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50343.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/validator/CVE-2024-50343.yaml
https://github.com/symfony/symfony

Updated Nov 03, 2025 · Source: OSV.dev
GHSA-4vf2-qfg3-7598 May 30, 2024

symfony/validator XML Entity Expansion vulnerability

7.5 / 10
High
Network Low None None Unchanged None None High

Symfony 2.0.11 carried a [similar] XXE security fix, however, on review of ZF2 I also noted a vulnerability to XML Entity Expansion (XEE) attacks whereby all extensions making use of libxml2 have no defense against XEE Quadratic Blowup Attacks. The vulnerability is a function of there being no current method of disabling custom entities in PHP (i.e. defined internal to the XML document without using external entities). In a QBA, a long entity can be defined and then referred to multiple times in document elements, creating a memory sink with which Denial Of Service attacks against a host's RAM can be mounted. The use of the LIBXML_NOENT or equivalent option in a dependent extension amplified the impact (it doesn't actually mean "No Entities"). In addition, libxml2's innate defense against the related Exponential or Billion Laugh's XEE attacks is active only so long as the LIBXML_PARSEHUGE is NOT set (it disables libxml2's hardcoded entity recursion limit). No instances of these two options were noted, but it's worth referencing for the future.

Consider this (non-fatal) example:

<?xml version="1.0"?> <!DOCTYPE data [<!ENTITY a "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa">]> <data>&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;</data>

Increase the length of entity, and entity count to a few hundred, and peak memory usage will waste no time spiking the moment the nodeValue for is accessed since the entities will then be expanded by a simple multiplier effect. No external entities required.

...

This can be used in combination with the usual XXE defense of calling libxml_disable_entity_loader(TRUE) and, optionally, the LIBXML_NONET option (should local filesystem access be allowable). The DOCTYPE may be removed instead of rejecting the XML outright but this would likely result in other problems with the unresolved entities. "

If you cannot upgrade to the latest Symfony version, you can also apply this patch.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.9

Fixed in

2.0.17

References

https://github.com/symfony/validator/commit/b5a30be97ac47181fa5c420bc70a924dff71a5c0
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/validator/2012-08-28.yaml
https://github.com/symfony/validator
https://symfony.com/blog/security-release-symfony-2-0-17-released

Updated Dec 05, 2024 · Source: OSV.dev
CVE-2013-4751 GHSA-q8j7-fjh7-25v5 May 05, 2022

Symfony collectionCascaded and collectionCascadedDeeply fields security bypass

8.1 / 10
High
Network Low Low None Unchanged High High None

When using the Validator component, if Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache is enabled (or any other cache implementing Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).

As a consequence, arrays or traversable objects stored in fields using the @Valid constraint are not traversed by the validator as soon as the validator configuration is loaded from the cache.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 26 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.2v2.2.3v2.2.4v2.3.0v2.3.1v2.3.2

Fixed in

2.0.242.1.122.2.52.3.3

References

https://nvd.nist.gov/vuln/detail/CVE-2013-4751
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4751
https://exchange.xforce.ibmcloud.com/vulnerabilities/86364
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-4751.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/validator/CVE-2013-4751.yaml
https://github.com/symfony/validator

Updated Feb 16, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 6
minor 29
patch 576
pre 85

697 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More