symfony/routing
Composer · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization | symfony/routingsymfony/symfony | Composer | Medium | Fix reported | |
| Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection | symfony/routingsymfony/symfony | Composer | Medium | Fix reported | |
| Symfony XXE security vulnerability | symfony/routing | Composer | High | Fix reported | |
| Symfony Allows URI Restrictions Bypass Via Double-Encoded String | symfony/http-foundationsymfony/routing | Composer | Medium | Fix reported | |
| CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control | symfony/routingsymfony/symfony | Composer | Unknown | No fix reported |