# symfony/routing (Packagist) vulnerabilities 4 known vulnerabilities (2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/symfony/routing ## Advisories (4) ### [CVE-2026-118516](https://cve.now/CVE-2026-118516): Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control - Severity: Medium 6.3 - Published: Nov 4, 2026 - Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11. ### [CVE-2026-48784](https://cve.now/CVE-2026-48784): Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained \`../\` or \`./\` → Generated URL Collapses Off-Route Under RFC 3986… - Severity: Medium 5.1 - Published: Jul 14, 2026 - Affected: fixed in 5.4.53; from 6.0.0, fixed in 6.4.41; from 7.0.0, fixed in 7.4.13; from 8.0.0, fixed in 8.0.13. ### [CVE-2026-45065](https://cve.now/CVE-2026-45065): Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection - Severity: Low 2.3 - Published: Jul 14, 2026 - Affected: fixed in 5.4.52; from 6.0.0, fixed in 6.4.40; from 7.0.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12. ### [CVE-2012-6431](https://cve.now/CVE-2012-6431): Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote… - Severity: Unrated - Published: Dec 27, 2012 - Affected: from 2.0.0, fixed in 2.0.19. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/symfony/routing Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.