Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
symfony/validator
8.2 @ 9014d4c
2
Fixes
1
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
Constraints/RegexValidator.php: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: PCRE backtracking engine failures (which return false) were treated as successful validation passes when match: false was configured, leading to a silent validation bypass. Developers must ensure all regex matching returns are explicitly verified against true match states.
XML External Entity (XXE): The XML constraint validation parsed schemas and payloads without safe XML loading flags, opening the application to XXE injection and SSRF during validation. Re-enabling parser-level safety flags (like LIBXML_NONET) is required.
Validation Bypass: Incomplete filtering of Unicode variation selectors allowed attackers to bypass character and string length constraints (as tracked in CVE-2025-12758).