Title: Debian Fixes Sixteen Symfony CVEs in DSA-6617-1
Summary:
On November 9, 2026, Debian published DSA-6617-1, a security update for the symfony PHP web framework that closes sixteen assigned vulnerabilities in one go: CVE-2026-118513, CVE-2026-118514, CVE-2026-118515, CVE-2026-118516, CVE-2026-118517, CVE-2026-121373, CVE-2026-121623, CVE-2026-121949, CVE-2026-121971, CVE-2026-122053, CVE-2026-123119, CVE-2026-123125, CVE-2026-123339, CVE-2026-123746, CVE-2026-123792, and CVE-2026-123824. Per Debian’s security tracker, Debian 13 (trixie) moves symfony from the vulnerable 6.4.41+dfsg-0+deb13u1 to fixed version 6.4.50+dfsg-0+deb13u1 in the security suite. Symfony is used both directly and as a dependency of many PHP applications, so admins running Symfony-based stacks on Debian 13 should pull the update as usual with apt update && apt upgrade. Check the tracker pages listed below for the individual CVE details.
References: