# Symfony v6.4.45

- Product: Symfony (https://whatsnew.fyi/product/symfony)
- Vendor: Symfony
- Date: 2026-08-30
- Version: v6.4.45
- Original notes: https://github.com/symfony/symfony/releases/tag/v6.4.45
- Permalink: https://whatsnew.fyi/product/symfony/releases/v6.4.45

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros
- **security** — Reject decompression bombs in HttpClient
- **changed** — Combine trusted host patterns into a single regexp in HttpFoundation
- **security** — Reject https:// proxies that curl would connect to in cleartext in HttpClient
- **fixed** — Cap the burst size and the duration computed from it in RateLimiter
- **security** — Don't send the original Host header on cross-authority redirects in HttpClient
- **security** — Reject 3xx pushed responses in HttpClient
- **fixed** — Drop trace args from FlattenException normalization in Messenger
- **security** — Reject an unquoted @ in the local part of an email address in Mime
- **fixed** — Ignore invalid env var names and non-scalar env values in Process
- **security** — Stop leaking CGI/FastCGI request-context vars to subprocesses in Process
- **fixed** — Avoid failing when PersistentRememberMeHandler handles a malformed cookie in Security
- **fixed** — Reject malformed login link parameters instead of throwing a TypeError in Security
- **fixed** — Remove the legacy nested unserialize() call from token and exception classes in Security
- **security** — Restrict redirections to the current host when sessions are disabled in SecurityBundle
- **security** — Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store
- **fixed** — Ignore the session id that PHP kept from a previous request in HttpKernel
- **fixed** — Fix TypeError in UriSigner when the hash parameter is not a string in HttpKernel
- **fixed** — Encode the path in the X-Accel-Redirect header in HttpFoundation
- **security** — Reject reserved characters in the cookie path and domain in HttpFoundation

**Changelog** (https://github.com/symfony/symfony/compare/v6.4.44...v6.4.45)

 * bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
 * bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
 * bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
 * bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
 * bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
 * bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
 * bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
 * bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
 * bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
 * bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
 * bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
 * bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
 * bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
 * bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
 * bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
 * bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
 * bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
 * bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
 * bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
 * bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
 * bug #65728 [Routing] Fix matching the "0" URL (@cs278)
 * bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
 * bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
 * bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
 * bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
 * bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
 * minor #65724  Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
 * bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
 * bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
 * bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
 * bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
 * bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
 * bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
 * bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
 * bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
 * bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
 * bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
 * bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
 * bug #65709 [Mailer][Mailgun] Reject non-string signature fields

_[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v6.4.45]_