Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

symfony/http-foundation

12 known vulnerabilities (2 high, 2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 2 high, 2 medium, 2 low
Registry
Packagist

Advisories 12

  • CVE-2026-118514Medium 6.3

    Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls

    Affected: fixed in 5.4.56; from 6, fixed in 6.4.50; from 7, fixed in 7.4.23; from 8, fixed in 8.1.11.

  • Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

    Affected: from 6.0.1, fixed in 6.4.46; from 7.0.0, fixed in 7.4.19; from 8.0.0, fixed in 8.1.7; from 4.1.0, fixed in 5.4.54.

  • CVE-2026-48736Medium 6.9

    Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in…

    Affected: from 6.4.0, fixed in 6.4.41; from 7.0.0, fixed in 7.4.13; from 8.0.0, fixed in 8.0.13.

  • Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    Affected: fixed in 5.4.50; from 6.0.0, fixed in 6.4.29; from 7.0.0, fixed in 7.3.7.

  • Open redirect via browser-sanitized URLs in symfony/http-foundation

    Affected: fixed in 5.4.46; from 6.0.0, fixed in 6.4.14; from 7.0.0, fixed in 7.1.7.

  • Prevent cache poisoning via a Response Content-Type header

    Affected: from 4.4.0, fixed in 4.4.7; from 5.0.0, fixed in 5.0.7.

  • Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component.

    Affected: from 2.0.0, fixed in 2.0.24; from 2.1.0, fixed in 2.1.12; from 2.2.0, fixed in 2.2.5; from 2.3.0, fixed in 2.3.3.

  • An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.

    Affected: from 2.0.0, fixed in 2.8.52; from 3.0.0, fixed in 3.4.35; from 4.0.0, fixed in 4.2.12; from 4.3.0, fixed in 4.3.8.

  • In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as…

    Affected: from 2.7.0, fixed in 2.7.51; from 2.8.0, fixed in 2.8.50; from 3.0.0, fixed in 3.4.26; from 4.0.0, fixed in 4.1.12; from 4.2.0, fixed in 4.2.7.

  • An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through…

    Affected: from 2.7.0, fixed in 2.7.49; from 2.8.0, fixed in 2.8.44; from 3.0.0, fixed in 3.3.18; from 3.4.0, fixed in 3.4.14; from 4.0.0, fixed in 4.0.14; from 4.1.0, fixed in 4.1.3.

  • An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x…

    Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.3.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.

  • Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote…

    Affected: from 2.0.0, fixed in 2.0.19.