CVE-2024-50343

What it actually does

A Validator using a regex pattern anchored with $ can be bypassed when attacker-controlled input ends with a literal newline character, because the $ anchor does not match before the final newline without the D regex modifier.

Why it matters to the business

Applications that rely on regex-based validation for input sanitization or access control may accept malformed data, increasing the chance of downstream logic errors or weak security checks in PHP web applications built on Symfony.

How an attack unfolds

An attacker identifies a validator rule that uses a $ anchor in its regex, crafts a payload that ends with a newline, and submits it through any entry point that reaches the validator, causing the pattern to match incorrectly and allowing the invalid value to pass.

How to fix it

Upgrade symfony/symfony (or the standalone symfony/validator component) to version 5.4.43, 6.4.11, 7.1.4 or newer; the fix applies the D regex modifier so that $ matches only at the absolute end of the string. The change is included in commit 4a4c52e875f544f502a3b63986088315d88ff840.

How to confirm the fix worked

After upgrade, confirm that regex validators now correctly reject inputs ending with a newline when the pattern uses $. Re-run existing validator test suites and add a regression test that supplies a trailing newline to any $ anchored pattern.

Typical attack path

1. Locate an endpoint or form that applies a regex-constrained validator
2. Append a literal newline to a value that would otherwise fail the anchored pattern
3. Submit the request and observe successful validation of the malformed input
4. Proceed to abuse the accepted value in subsequent application logic

How to detect it

No public exploitation is known; look for validator-related log entries or application errors that unexpectedly accept values containing trailing newlines in regex-constrained fields. Examine request logs for patterns ending with %0A or literal line breaks reaching validator services.

What your security team should do

• Prioritize upgrade of all Symfony 5.4, 6.4, and 7.x installations to the patched releases within normal change windows
• Review custom validator constraints that use $ anchors and add explicit tests for trailing newlines
• Monitor EPSS and KEV status; current low exploitability does not require emergency patching