--- title: Symfony 8.1.10 released (Symfony Blog) | daily.dev description: Symfony 8.1.10 ships with a large batch of bug fixes and four security patches. The ExpressionLanguage component now bounds the nesting level of parsed... canonical: https://daily.dev/posts/symfony-8-1-10-released-symfony-blog--9fw9bjdi8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Symfony 8.1.10 released (Symfony Blog) | daily.dev og:description: Symfony 8.1.10 ships with a large batch of bug fixes and four security patches. The ExpressionLanguage component now bounds the nesting level of parsed... og:url: https://daily.dev/posts/symfony-8-1-10-released-symfony-blog--9fw9bjdi8 og:image: https://api.daily.dev/og/posts/9FW9BjDi8.png og:image:alt: Symfony 8.1.10 released (Symfony Blog) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Symfony 8.1.10 released (Symfony Blog) **[Symfony](https://daily.dev/sources/symfony)** · 16 min read · 1 upvotes · 0 comments ## Summary Symfony 8.1.10 ships with a large batch of bug fixes and four security patches. The ExpressionLanguage component now bounds the nesting level of parsed expressions to fix CVE-2026-109449. HttpFoundation's HeaderUtils::split() gets a fix for backtracking ambiguity under CVE-2026-108082. Mime now rejects parameter names with non-token characters (CVE-2026-45070), and Yaml bounds recursion depth in its inline lexer (CVE-2026-109413). Dozens of other fixes touch Cache, Console, DomCrawler, Messenger, HttpClient, Serializer, and more. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security issues does Symfony 8.1.10 fix? Symfony 8.1.10 fixes four CVEs: CVE-2026-109449 bounds the nesting level of parsed ExpressionLanguage expressions, CVE-2026-108082 removes ambiguity causing HeaderUtils::split() to backtrack in HttpFoundation, CVE-2026-45070 rejects Mime parameter names with non-token characters, and CVE-2026-109413 bounds recursion depth in the Yaml component's inline lexer. _Developers patching Symfony against the latest CVEs can track releases like this on daily.dev._ ### Does Symfony 8.1.10 fix issues with the Messenger Redis transport? Yes, Symfony 8.1.10 fixes the Redis transport after a lost connection and prevents losing delayed Redis messages on migration failure. It also fixes the in-memory transport decoding the whole queue on each get() call and corrects Amazon SQS connections losing buffered messages when a receive fails. _Teams running Symfony Messenger in production follow fixes like these on daily.dev._ ### What Console component bugs were fixed in Symfony 8.1.10? Symfony 8.1.10 fixes numerous Console issues including raw token stripping when an option value matches the command name, style names with uppercase letters not being applied, table header cells spanning rows with escaped tags, alignment of wrapped table cells, styles leaking out of table cells, and shell completion conflicts between global options and the _complete option. _PHP developers debugging CLI tool quirks keep up with fixes like these on daily.dev._ ## Similar posts on daily.dev - [Symfony 8.1 curated new features \(Symfony Blog\)](https://daily.dev/posts/symfony-8-1-curated-new-features-symfony-blog--9qonflcdy) · Symfony · 4 upvotes · 0 comments - [Symfony 8.1.0-RC1 released \(Symfony Blog\)](https://daily.dev/posts/symfony-8-1-0-rc1-released-symfony-blog--pavbrnggs) · Symfony · 1 upvotes · 0 comments --- Tags: [#php](https://daily.dev/tags/php), [#symfony](https://daily.dev/tags/symfony) [View this post on daily.dev](https://daily.dev/posts/symfony-8-1-10-released-symfony-blog--9fw9bjdi8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Symfony 8.1.10 released (Symfony Blog)","url":"https://daily.dev/posts/symfony-8-1-10-released-symfony-blog--9fw9bjdi8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/symfony-8-1-10-released-symfony-blog--9fw9bjdi8"},"datePublished":"2026-10-28T19:57:09.158Z","dateModified":"2026-10-28T21:33:33.592Z","description":"Symfony 8.1.10 ships with a large batch of bug fixes and four security patches. The ExpressionLanguage component now bounds the nesting level of parsed...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Symfony","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Symfony","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/cc07051b7112472f9729e73c14660a64","url":"https://daily.dev/sources/symfony"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/symfony-8-1-10-released-symfony-blog--9fw9bjdi8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,symfony","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Symfony","item":"https://daily.dev/sources/symfony"},{"@type":"ListItem","position":3,"name":"Symfony 8.1.10 released (Symfony Blog)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/symfony-8-1-10-released-symfony-blog--9fw9bjdi8#faq","mainEntity":[{"@type":"Question","name":"What security issues does Symfony 8.1.10 fix?","acceptedAnswer":{"@type":"Answer","text":"Symfony 8.1.10 fixes four CVEs: CVE-2026-109449 bounds the nesting level of parsed ExpressionLanguage expressions, CVE-2026-108082 removes ambiguity causing HeaderUtils::split() to backtrack in HttpFoundation, CVE-2026-45070 rejects Mime parameter names with non-token characters, and CVE-2026-109413 bounds recursion depth in the Yaml component's inline lexer. Developers patching Symfony against the latest CVEs can track releases like this on daily.dev."}},{"@type":"Question","name":"Does Symfony 8.1.10 fix issues with the Messenger Redis transport?","acceptedAnswer":{"@type":"Answer","text":"Yes, Symfony 8.1.10 fixes the Redis transport after a lost connection and prevents losing delayed Redis messages on migration failure. It also fixes the in-memory transport decoding the whole queue on each get() call and corrects Amazon SQS connections losing buffered messages when a receive fails. Teams running Symfony Messenger in production follow fixes like these on daily.dev."}},{"@type":"Question","name":"What Console component bugs were fixed in Symfony 8.1.10?","acceptedAnswer":{"@type":"Answer","text":"Symfony 8.1.10 fixes numerous Console issues including raw token stripping when an option value matches the command name, style names with uppercase letters not being applied, table header cells spanning rows with escaped tags, alignment of wrapped table cells, styles leaking out of table cells, and shell completion conflicts between global options and the _complete option. PHP developers debugging CLI tool quirks keep up with fixes like these on daily.dev."}}]} ```