--- title: Symfony 6.4.45 released (Symfony Blog) | daily.dev description: Symfony 6.4.45 has shipped with a large batch of bug fixes spanning HttpClient, HttpFoundation, Security, Serializer, Yaml, VarDumper, and more components.... canonical: https://daily.dev/posts/symfony-6-4-45-released-symfony-blog--d8hiu7gnc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Symfony 6.4.45 released (Symfony Blog) | daily.dev og:description: Symfony 6.4.45 has shipped with a large batch of bug fixes spanning HttpClient, HttpFoundation, Security, Serializer, Yaml, VarDumper, and more components.... og:url: https://daily.dev/posts/symfony-6-4-45-released-symfony-blog--d8hiu7gnc og:image: https://api.daily.dev/og/posts/D8HiU7gNc.png og:image:alt: Symfony 6.4.45 released (Symfony Blog) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Symfony 6.4.45 released (Symfony Blog) **[Symfony](https://daily.dev/sources/symfony)** · 6 min read · 1 upvotes · 0 comments ## Summary Symfony 6.4.45 has shipped with a large batch of bug fixes spanning HttpClient, HttpFoundation, Security, Serializer, Yaml, VarDumper, and more components. Notable fixes include rejecting decompression bombs, capping rate limiter burst sizes, restricting redirections to the current host when sessions are disabled, rejecting malformed login link parameters, and various hardening changes around cookies, sessions, and unserialize() calls. The release also includes numerous translation reviews for locales including Persian, Indonesian, Dutch, Estonian, Bulgarian, Serbian, Turkish, Polish, Russian, and Urdu. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What changed in Symfony 6.4.45's HttpClient component regarding proxies and redirects? Symfony 6.4.45 rejects https:// proxies that curl would connect to in cleartext, rejects decompression bombs, rejects 3xx pushed responses, drops credentials when a redirect changes the scheme, and stops sending the original Host header on cross-authority redirects. These changes tighten HttpClient's handling of untrusted or malicious server responses. _Teams tracking Symfony HttpClient hardening details can follow release changelogs like this on daily.dev._ ### Does Symfony 6.4.45 fix any session or login security issues? Yes, it restricts redirections to the current host when sessions are disabled, narrows a race condition that let a login link exceed max_uses, ignores session ids left over from a previous PHP request, and makes PersistentRememberMeHandler avoid failing on a malformed cookie. It also switches login throttling to use a lock by default. _Developers hardening Symfony authentication flows can keep up with fixes like these via daily.dev._ ### How does Symfony 6.4.45 handle PHP 8.6 deprecations? Symfony 6.4.45 updates VarDumper to account for PHP 8.6 deprecating SplFileObject::getCsvControl(), avoiding deprecation warnings when running on that PHP version. This is one of several compatibility fixes included alongside dozens of other bug fixes across HttpFoundation, Security, Serializer, and Yaml components. _Developers preparing Symfony apps for newer PHP versions can track compatibility fixes on daily.dev._ ## Similar posts on daily.dev - [Symfony 6.4.43 released \(Symfony Blog\)](https://daily.dev/posts/symfony-6-4-43-released-symfony-blog--dhnkfonft) · Symfony · 1 upvotes · 0 comments - [Symfony 6.4.44 released \(Symfony Blog\)](https://daily.dev/posts/symfony-6-4-44-released-symfony-blog--m5kurxwtz) · Symfony · 0 upvotes · 0 comments - [Symfony 6.4.39 released \(Symfony Blog\)](https://daily.dev/posts/symfony-6-4-39-released-symfony-blog--gidr9nvyt) · Symfony · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#symfony](https://daily.dev/tags/symfony) [View this post on daily.dev](https://daily.dev/posts/symfony-6-4-45-released-symfony-blog--d8hiu7gnc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Symfony 6.4.45 released (Symfony Blog)","url":"https://daily.dev/posts/symfony-6-4-45-released-symfony-blog--d8hiu7gnc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/symfony-6-4-45-released-symfony-blog--d8hiu7gnc"},"datePublished":"2026-08-30T22:15:58.058Z","dateModified":"2026-08-30T22:16:21.016Z","description":"Symfony 6.4.45 has shipped with a large batch of bug fixes spanning HttpClient, HttpFoundation, Security, Serializer, Yaml, VarDumper, and more components....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Symfony","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Symfony","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/cc07051b7112472f9729e73c14660a64","url":"https://daily.dev/sources/symfony"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/symfony-6-4-45-released-symfony-blog--d8hiu7gnc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,symfony","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Symfony","item":"https://daily.dev/sources/symfony"},{"@type":"ListItem","position":3,"name":"Symfony 6.4.45 released (Symfony Blog)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/symfony-6-4-45-released-symfony-blog--d8hiu7gnc#faq","mainEntity":[{"@type":"Question","name":"What changed in Symfony 6.4.45's HttpClient component regarding proxies and redirects?","acceptedAnswer":{"@type":"Answer","text":"Symfony 6.4.45 rejects https:// proxies that curl would connect to in cleartext, rejects decompression bombs, rejects 3xx pushed responses, drops credentials when a redirect changes the scheme, and stops sending the original Host header on cross-authority redirects. These changes tighten HttpClient's handling of untrusted or malicious server responses. Teams tracking Symfony HttpClient hardening details can follow release changelogs like this on daily.dev."}},{"@type":"Question","name":"Does Symfony 6.4.45 fix any session or login security issues?","acceptedAnswer":{"@type":"Answer","text":"Yes, it restricts redirections to the current host when sessions are disabled, narrows a race condition that let a login link exceed max_uses, ignores session ids left over from a previous PHP request, and makes PersistentRememberMeHandler avoid failing on a malformed cookie. It also switches login throttling to use a lock by default. Developers hardening Symfony authentication flows can keep up with fixes like these via daily.dev."}},{"@type":"Question","name":"How does Symfony 6.4.45 handle PHP 8.6 deprecations?","acceptedAnswer":{"@type":"Answer","text":"Symfony 6.4.45 updates VarDumper to account for PHP 8.6 deprecating SplFileObject::getCsvControl(), avoiding deprecation warnings when running on that PHP version. This is one of several compatibility fixes included alongside dozens of other bug fixes across HttpFoundation, Security, Serializer, and Yaml components. Developers preparing Symfony apps for newer PHP versions can track compatibility fixes on daily.dev."}}]} ```