--- title: Symfony 6.4.49 released (Symfony Blog) | daily.dev description: Symfony 6.4.49 ships as a maintenance release fixing bugs across dozens of components. It patches four security issues: unbounded nesting in ExpressionLanguage... canonical: https://daily.dev/posts/symfony-6-4-49-released-symfony-blog--7ikst8grz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Symfony 6.4.49 released (Symfony Blog) | daily.dev og:description: Symfony 6.4.49 ships as a maintenance release fixing bugs across dozens of components. It patches four security issues: unbounded nesting in ExpressionLanguage... og:url: https://daily.dev/posts/symfony-6-4-49-released-symfony-blog--7ikst8grz og:image: https://api.daily.dev/og/posts/7ikST8GRz.png og:image:alt: Symfony 6.4.49 released (Symfony Blog) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Symfony 6.4.49 released (Symfony Blog) **[Symfony](https://daily.dev/sources/symfony)** · 12 min read · 0 upvotes · 0 comments ## Summary Symfony 6.4.49 ships as a maintenance release fixing bugs across dozens of components. It patches four security issues: unbounded nesting in ExpressionLanguage parsing, backtracking in HttpFoundation's HeaderUtils::split(), invalid token characters in Mime parameter names, and unbounded recursion depth in the Yaml inline lexer. Other fixes cover Cache (tag loss on concurrent invalidation), Console (table rendering, style leaks), DependencyInjection (lazy closures and circular references), Messenger (Redis transport after lost connections), and HttpFoundation session handling. The release also includes translation updates for languages including Persian, Arabic, Swedish, and Central Kurdish. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security vulnerabilities does Symfony 6.4.49 fix? Symfony 6.4.49 fixes four CVEs: CVE-2026-109449 bounds the nesting level of parsed expressions in ExpressionLanguage, CVE-2026-108082 removes ambiguity causing backtracking in HttpFoundation's HeaderUtils::split(), CVE-2026-45070 rejects parameter names with non-token characters in Mime, and CVE-2026-109413 bounds recursion depth in the Yaml inline lexer. _Developers patching Symfony apps can track new CVEs and release notes on daily.dev._ ### Does Symfony 6.4.49 fix any Messenger Redis transport issues? Yes, Symfony 6.4.49 fixes the Redis transport after a lost connection in Messenger, along with acknowledging messages sent for retry, fixing the Amazon SQS connection rethrowing the same error after a failed receive, and preventing lost delayed Redis messages on migration failure. _Teams running Messenger queues in production can follow fixes like these on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#symfony](https://daily.dev/tags/symfony) [View this post on daily.dev](https://daily.dev/posts/symfony-6-4-49-released-symfony-blog--7ikst8grz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Symfony 6.4.49 released (Symfony Blog)","url":"https://daily.dev/posts/symfony-6-4-49-released-symfony-blog--7ikst8grz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/symfony-6-4-49-released-symfony-blog--7ikst8grz"},"datePublished":"2026-10-28T18:25:50.653Z","dateModified":"2026-10-28T18:38:09.638Z","description":"Symfony 6.4.49 ships as a maintenance release fixing bugs across dozens of components. It patches four security issues: unbounded nesting in ExpressionLanguage...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Symfony","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Symfony","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/cc07051b7112472f9729e73c14660a64","url":"https://daily.dev/sources/symfony"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/symfony-6-4-49-released-symfony-blog--7ikst8grz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,symfony","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Symfony","item":"https://daily.dev/sources/symfony"},{"@type":"ListItem","position":3,"name":"Symfony 6.4.49 released (Symfony Blog)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/symfony-6-4-49-released-symfony-blog--7ikst8grz#faq","mainEntity":[{"@type":"Question","name":"What security vulnerabilities does Symfony 6.4.49 fix?","acceptedAnswer":{"@type":"Answer","text":"Symfony 6.4.49 fixes four CVEs: CVE-2026-109449 bounds the nesting level of parsed expressions in ExpressionLanguage, CVE-2026-108082 removes ambiguity causing backtracking in HttpFoundation's HeaderUtils::split(), CVE-2026-45070 rejects parameter names with non-token characters in Mime, and CVE-2026-109413 bounds recursion depth in the Yaml inline lexer. Developers patching Symfony apps can track new CVEs and release notes on daily.dev."}},{"@type":"Question","name":"Does Symfony 6.4.49 fix any Messenger Redis transport issues?","acceptedAnswer":{"@type":"Answer","text":"Yes, Symfony 6.4.49 fixes the Redis transport after a lost connection in Messenger, along with acknowledging messages sent for retry, fixing the Amazon SQS connection rethrowing the same error after a failed receive, and preventing lost delayed Redis messages on migration failure. Teams running Messenger queues in production can follow fixes like these on daily.dev."}}]} ```