{"action":"Upgrade symfony to 3.4.22+dfsg-2 or later.","affected":[{"fixed":"3.4.22+dfsg-2","introduced":"0"}],"component":"symfony","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["3.4.22+dfsg-2"],"id":"tcs_01M5NDNDFGFE4GGFM1ZPKE75H4","modified_at":"2026-09-21T07:01:57.485356056Z","published_at":"2019-05-16T22:29:00.580Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-10912","https://security-tracker.debian.org/tracker/CVE-2019-10912"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-10912#Debian:13/symfony","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-10912"}],"summary":"In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could"}