Symfony released version 6.4.45 on August 30, 2026, tagged by lead maintainer Fabien Potencier, alongside parallel updates 7.4.18 and 8.1.6 for its other currently maintained branches. The changelog is dominated by defensive fixes, most of them authored by Nicolas Grekas.

HttpClient now rejects decompression bombs, blocks https:// proxies that curl would otherwise reach over cleartext, drops the original Host header on cross-authority redirects, strips credentials when a redirect changes scheme, and refuses 3xx pushed responses. HttpFoundation combines trusted host patterns into a single regular expression, rejects reserved characters and invalid values in cookie paths and domains, fixes host and scheme parsing in URLs, and properly encodes the path sent in the X-Accel-Redirect header.

The Security component now handles malformed remember-me cookies and malformed login link parameters gracefully instead of throwing errors, closes a race condition that allowed a login link to exceed its configured max_uses, and removes a legacy nested unserialize() call from token and exception classes. SecurityBundle restricts post-login redirects to the current host when sessions are disabled and turns on a lock for login throttling by default. RateLimiter now caps burst size and the duration derived from it.

Mailer and Notifier tighten webhook validation: Mailgun, SendGrid and Vonage requests with a stale timestamp are rejected, Postmark webhooks are checked against the configured secret, and Telegram's MarkdownV2 escaping was corrected. Yaml bounds recursion depth in its inline lexer and fixes a TypeError on unparsable !!binary values, while ExpressionLanguage caps the nesting depth of parsed expressions. Several remaining unserialize() calls across HttpKernel-related classes were hardened with allowed_classes => false.

The release also folds in translation reviews for Persian, Indonesian, Dutch, Spanish, Estonian, Bulgarian, Serbian, Turkish, Polish, Russian and Urdu message catalogs.