The following session handlers:

• MemcachedSessionHandler
• MemcacheSessionHandler
• MongoDbSessionHandler
• PdoSessionHandler done

do not use a lock to serialize access to the session data. This might result in a data corruption / lose of data when two requests are modifying the session data at the same time.

see #4668

edit:

This is also applicable to Symfony/Bridge/Doctrine/HttpFoundation/DbalSessionHandler.php