Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

🗓️ 15 Jun 2026 17:32:28Reported by GitHub Advisory DatabaseType

Symfony Mailomat webhook now requires a sha256 header and uses constant-time HMAC-SHA256 verification.

Reporter	Title	Published	Views	Family All 17
Circl	CVE-2026-48747	27 May 202610:03	–	circl
CVE	CVE-2026-48747	14 Jul 202619:16	–	cve
Cvelist	CVE-2026-48747 Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	14 Jul 202619:16	–	cvelist
Debian CVE	CVE-2026-48747	14 Jul 202619:16	–	debiancve
EUVD	EUVD-2026-44375	14 Jul 202619:16	–	euvd
Friends Of PHP	CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	1 Jan 197000:00	–	friendsofphp
NVD	CVE-2026-48747	14 Jul 202620:17	–	nvd
OSV	CVE-2026-48747 Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	14 Jul 202619:16	–	osv
OSV	DEBIAN-CVE-2026-48747	14 Jul 202620:17	–	osv

Vulners

Node

symfony symfonyRange8.0.0–8.0.13composer

symfony symfonyRange7.2.0–7.4.13composer

symfony mailomat-mailerRange8.0.0–8.0.13composer

symfony mailomat-mailerRange7.2.0–7.4.13composer

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-rrj9-5q2j-4gvr
github	www.github.com/symfony/symfony/commit/bdfe9fe0d94d33dfaca0bc2fe0b00b54767b0c88
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailomat-mailer/CVE-2026-48747.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48747.yaml
symfony	www.symfony.com/cve-2026-48747
github	www.github.com/advisories/GHSA-rrj9-5q2j-4gvr

15 Jun 2026 17:32Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.3

CVSS 46.3

EPSS0.00197

SSVC