GHSA-RRJ9-5Q2J-4GVR Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

🗓️ 15 Jun 2026 17:32:28Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Symfony Mailomat webhook now requires sha256 hex and constant-time HMAC-SHA256 verification; weaker algorithms rejected.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-48747	27 May 202610:03	–	circl
CVE	CVE-2026-48747	27 May 202610:03	–	cve
Debian CVE	CVE-2026-48747	27 May 202610:03	–	debiancve
Friends Of PHP	CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	1 Jan 197000:00	–	friendsofphp
Github Security Blog	Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	15 Jun 202617:32	–	github
OSV	DEBIAN-CVE-2026-48747	27 May 202619:48	–	osv
OSV	UBUNTU-CVE-2026-48747	29 May 202600:00	–	osv
Positive Technologies	PT-2026-44170	27 May 202600:00	–	ptsecurity
Snyk	Improper Verification of Cryptographic Signature	27 May 202609:41	–	snyk

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-rrj9-5q2j-4gvr
github	www.github.com/symfony/symfony/commit/bdfe9fe0d94d33dfaca0bc2fe0b00b54767b0c88
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailomat-mailer/CVE-2026-48747.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48747.yaml
github	www.github.com/symfony/symfony
symfony	www.symfony.com/cve-2026-48747

15 Jun 2026 17:45Current

5.5Medium risk

Vulners AI Score5.5

EPSS0.00018