- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 8 · 2 high, 2 medium, 1 low
- Registry
- Packagist
Advisories 8
- CVE-2026-123339Low 2.3
Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.
- CVE-2026-45075High 8.3
Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Affected: from 7.4.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.
- CVE-2022-24894Medium 5.9
Symfony storing cookie headers in HttpCache
Affected: from 2.0.0, fixed in 4.4.50; from 5.0.0, fixed in 5.4.20; from 6.0.0, fixed in 6.0.20; from 6.1.0, fixed in 6.1.12; from 6.2.0, fixed in 6.2.6.
- CVE-2021-41267Medium 6.5
Webcache Poisoning in Symfony
Affected: from 5.2.0, fixed in 5.3.12.
- CVE-2020-15094High 8.0
RCE in Symfony
Affected: from 4.3.0, fixed in 4.4.13; from 5.0.0, fixed in 5.1.5.
- CVE-2019-18887Unrated
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.
Affected: from 2.2.0, fixed in 2.8.52; from 3.0.0, fixed in 3.4.35; from 4.0.0, fixed in 4.2.12; from 4.3.0, fixed in 4.3.8.
- CVE-2015-2308Unrated
Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x…
Affected: from 2.0.0, fixed in 2.3.27; from 2.4.0, fixed in 2.5.11; from 2.6.0, fixed in 2.6.6.
- CVE-2015-4050Unrated
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0…
Affected: from 2.3.19, fixed in 2.3.29; from 2.5.4, fixed in 2.5.12; from 2.6.0, fixed in 2.6.8; from 2.4.9, through 2.4.10.