Security
فارسی
All products

symfony/http-foundation

Composer · Package
19 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderCVE-2026-108082 · GHSA-R925-MGVR-H9CCVersion ranges need review. symfony/http-foundationsymfony/symfony Composer High Fix reported
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClientCVE-2026-48736 · GHSA-38CX-CQ6F-5755Version ranges need review. symfony/http-clientsymfony/http-foundation Composer Medium Fix reported
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypassCVE-2025-64500 · GHSA-3RG7-WF37-54RMVersion ranges need review. symfony/http-foundationsymfony/symfony Composer High Fix reported
Symfony vulnerable to open redirect via browser-sanitized URLsCVE-2024-50345 · GHSA-MRQX-RP3W-JPJPVersion ranges need review. symfony/http-foundationsymfony/symfony Composer Low Fix reported
Symfony2 security issue when the trust proxy mode is enabledGHSA-VFM6-R2GC-PWWW · PKSA-629B-VQJQ-V1KHVersion ranges need review. symfony/http-foundationsymfony/symfony Composer Medium Fix reported
Symfony Allows URI Restrictions Bypass Via Double-Encoded StringCVE-2012-6431 · GHSA-83C3-QX27-2RWR symfony/http-foundationsymfony/routing Composer Medium Fix reported
Symfony has unsafe methods in the Request classCVE-2015-2309 · GHSA-P684-F7FH-JV2JVersion ranges need review. symfony/http-foundationsymfony/symfony Composer Medium Fix reported
Symfony has a security issue when parsing the Authorization headerCVE-2014-6061 · GHSA-H7V2-2QWG-H829Version ranges need review. symfony/http-foundationsymfony/symfony Composer Medium Fix reported
Symfony vulnerable to denial of service via a malicious HTTP Host headerCVE-2014-5244 · GHSA-V77V-X634-9M56Version ranges need review. symfony/http-foundationsymfony/symfony Composer High Fix reported
Symfony Host Header Injection vulnerability in the HttpFoundation componentCVE-2013-4752 · GHSA-22PV-7V9J-HQXPVersion ranges need review. symfony/http-foundationsymfony/symfony Composer Medium Fix reported
Argument injection in a MimeTypeGuesser in SymfonyCVE-2019-18888 · GHSA-XHH6-956Q-4Q69Version ranges need review. symfony/http-foundationsymfony/mime Composer High Fix reported
Symfony DoSCVE-2018-11386 · GHSA-R2RQ-3H56-FQM4Version ranges need review. symfony/http-foundationsymfony/symfony Composer Medium Fix reported
Symfony HTTP Foundation web cache poisoningCVE-2018-14773 · GHSA-8WGJ-6WX8-H5HQVersion ranges need review. symfony/http-foundationsymfony/symfony Composer Medium Fix reported
Prevent cache poisoning via a Response Content-Type header in SymfonyCVE-2020-5255 · GHSA-MCX4-F5F5-4859Version ranges need review. symfony/http-foundationsymfony/symfony Composer Low Fix reported
Invalid HTTP method overrides allow possible XSS or other attacks in SymfonyCVE-2019-10913 · GHSA-X92H-WMG2-6HP7Version ranges need review. symfony/http-foundationsymfony/symfony Composer Critical Fix reported
Generated URLs Can Point to a Host Chosen by the ClientPKSA-B2GG-VK1G-6D5Q symfony/http-foundation Composer Unknown No fix reported
The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse ProxiesPKSA-NXJS-S6HN-VB6M symfony/http-foundation Composer Unknown No fix reported
Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script NamePKSA-PR6Q-2W5S-KZZF symfony/http-foundation Composer Unknown No fix reported
CVE-2026-118514: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075CVE-2026-118514 · PKSA-24PH-XKRH-Y79J symfony/http-foundationsymfony/symfony Composer Unknown No fix reported