They do, and the patch for this CVE adds a test case for this bug: https://github.com/symfony/symfony/commit/f0ffb775febdf07e57...