# symfony/http-foundation (Packagist) vulnerabilities 12 known vulnerabilities (2 high, 2 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/symfony/http-foundation ## Advisories (12) ### [CVE-2026-118514](https://cve.now/CVE-2026-118514): Symfony: HEAD Requests Bypass the methods Option of security.access\_control Rules and Firewalls - Severity: Medium 6.3 - Published: Nov 6, 2026 - Affected: fixed in 5.4.56; from 6, fixed in 6.4.50; from 7, fixed in 7.4.23; from 8, fixed in 8.1.11. ### [CVE-2026-108082](https://cve.now/CVE-2026-108082): Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header - Severity: High 8.7 - Published: Oct 15, 2026 - Affected: from 6.0.1, fixed in 6.4.46; from 7.0.0, fixed in 7.4.19; from 8.0.0, fixed in 8.1.7; from 4.1.0, fixed in 5.4.54. ### [CVE-2026-48736](https://cve.now/CVE-2026-48736): Symfony: IpUtils::PRIVATE\_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in… - Severity: Medium 6.9 - Published: Jul 14, 2026 - Affected: from 6.4.0, fixed in 6.4.41; from 7.0.0, fixed in 7.4.13; from 8.0.0, fixed in 8.0.13. ### [CVE-2025-64500](https://cve.now/CVE-2025-64500): Symfony's incorrect parsing of PATH\_INFO can lead to limited authorization bypass - Severity: High 7.3 - Published: Nov 12, 2025 - Affected: fixed in 5.4.50; from 6.0.0, fixed in 6.4.29; from 7.0.0, fixed in 7.3.7. ### [CVE-2024-50345](https://cve.now/CVE-2024-50345): Open redirect via browser-sanitized URLs in symfony/http-foundation - Severity: Low 3.1 - Published: Nov 6, 2024 - Affected: fixed in 5.4.46; from 6.0.0, fixed in 6.4.14; from 7.0.0, fixed in 7.1.7. ### [CVE-2020-5255](https://cve.now/CVE-2020-5255): Prevent cache poisoning via a Response Content-Type header - Severity: Low 2.6 - Published: Mar 30, 2020 - Affected: from 4.4.0, fixed in 4.4.7; from 5.0.0, fixed in 5.0.7. ### [CVE-2013-4752](https://cve.now/CVE-2013-4752): Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. - Severity: Unrated - Published: Jan 2, 2020 - Affected: from 2.0.0, fixed in 2.0.24; from 2.1.0, fixed in 2.1.12; from 2.2.0, fixed in 2.2.5; from 2.3.0, fixed in 2.3.3. ### [CVE-2019-18888](https://cve.now/CVE-2019-18888): An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. - Severity: Unrated - Published: Nov 21, 2019 - Affected: from 2.0.0, fixed in 2.8.52; from 3.0.0, fixed in 3.4.35; from 4.0.0, fixed in 4.2.12; from 4.3.0, fixed in 4.3.8. ### [CVE-2019-10913](https://cve.now/CVE-2019-10913): In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as… - Severity: Unrated - Published: May 16, 2019 - Affected: from 2.7.0, fixed in 2.7.51; from 2.8.0, fixed in 2.8.50; from 3.0.0, fixed in 3.4.26; from 4.0.0, fixed in 4.1.12; from 4.2.0, fixed in 4.2.7. ### [CVE-2018-14773](https://cve.now/CVE-2018-14773): An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through… - Severity: Unrated - Published: Aug 3, 2018 - Affected: from 2.7.0, fixed in 2.7.49; from 2.8.0, fixed in 2.8.44; from 3.0.0, fixed in 3.3.18; from 3.4.0, fixed in 3.4.14; from 4.0.0, fixed in 4.0.14; from 4.1.0, fixed in 4.1.3. ### [CVE-2018-11386](https://cve.now/CVE-2018-11386): An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x… - Severity: Unrated - Published: Jun 13, 2018 - Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.3.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11. ### [CVE-2012-6431](https://cve.now/CVE-2012-6431): Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote… - Severity: Unrated - Published: Dec 27, 2012 - Affected: from 2.0.0, fixed in 2.0.19. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/symfony/http-foundation Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.