Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

symfony/routing

4 known vulnerabilities (2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 medium, 1 low
Registry
Packagist

Advisories 4

  • CVE-2026-118516Medium 6.3

    Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

    Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.

  • CVE-2026-48784Medium 5.1

    Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986…

    Affected: fixed in 5.4.53; from 6.0.0, fixed in 6.4.41; from 7.0.0, fixed in 7.4.13; from 8.0.0, fixed in 8.0.13.

  • Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

    Affected: fixed in 5.4.52; from 6.0.0, fixed in 6.4.40; from 7.0.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.

  • Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote…

    Affected: from 2.0.0, fixed in 2.0.19.