symfony/http-foundation

Defines an object-oriented layer for the HTTP specification

View on Packagist

View on Github

Activity

Latest release: 2w ago
Total releases: 689
Cadence: ~daily
Last 12 months: 59

Reach

Stars: 8.6k

Details

License: MIT
First release: Sep 29, 2011

Releases

Version	Released
`v8.1.6` patch	Aug 30, 2026
`v7.4.18` patch	Aug 30, 2026
`v6.4.45` patch	Aug 30, 2026
`v8.1.5` patch	Aug 20, 2026
`v7.4.17` patch	Aug 20, 2026
`v6.4.44` patch	Aug 20, 2026
`v8.1.4` patch	Aug 07, 2026
`v7.4.16` patch	Aug 07, 2026
`v8.1.2` patch	Jul 29, 2026
`v8.0.15` patch	Jul 29, 2026
`v7.4.15` patch	Jul 29, 2026
`v6.4.43` patch	Jul 29, 2026
`v6.4.42` patch	Jun 16, 2026
`v8.1.1` patch	Jun 12, 2026
`v8.0.14` patch	Jun 12, 2026
`v7.4.14` patch	Jun 11, 2026
`v8.1.0` minor	May 29, 2026
`v8.1.0-RC1` pre	May 24, 2026
`v8.0.13` patch	May 24, 2026
`v7.4.13` patch	May 24, 2026
`v6.4.41` patch	May 24, 2026
`v8.1.0-BETA3` pre	May 19, 2026
`v8.1.0-BETA1` pre	May 05, 2026
`v8.0.8` patch 1 CVE	Mar 30, 2026
`v7.4.8` patch 1 CVE	Mar 24, 2026
`v8.0.7` patch 1 CVE	Mar 06, 2026
`v7.4.7` patch 1 CVE	Mar 06, 2026
`v6.4.35` patch 1 CVE	Mar 06, 2026
`v8.0.6` patch 1 CVE	Feb 21, 2026
`v7.4.6` patch 1 CVE	Feb 21, 2026
`v6.4.34` patch 1 CVE	Feb 21, 2026
`v8.0.5` patch 1 CVE	Jan 27, 2026
`v7.4.5` patch 1 CVE	Jan 27, 2026
`v7.3.11` patch 1 CVE	Jan 27, 2026
`v6.4.33` patch 1 CVE	Jan 27, 2026
`v8.0.4` patch 1 CVE	Jan 09, 2026
`v7.4.4` patch 1 CVE	Jan 09, 2026
`v7.3.10` patch 1 CVE	Jan 09, 2026
`v6.4.32` patch 1 CVE	Jan 09, 2026
`v8.0.3` patch 1 CVE	Dec 23, 2025
`v7.4.3` patch 1 CVE	Dec 23, 2025
`v7.3.9` patch 1 CVE	Dec 19, 2025
`v6.4.31` patch 1 CVE	Dec 17, 2025
`v8.0.1` patch 1 CVE	Dec 07, 2025
`v7.4.1` patch 1 CVE	Dec 07, 2025
`v7.3.8` patch 1 CVE	Dec 04, 2025
`v6.4.30` patch 1 CVE	Dec 01, 2025
`v8.0.0` major 1 CVE	Nov 13, 2025
`v7.4.0` minor 1 CVE	Nov 13, 2025
`v7.3.7` patch 1 CVE	Nov 08, 2025

1–50 of 689

Repository

symfony/http-foundation

Forks: 306
Open issues: 0
Language: PHP
: 4.5/ 10

php
symfony
component
symfony-component

Dependencies (2)

Depends on

v8.1.6

Used by

5377

Supply-chain exposure

5,377 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (14)

CVE-2026-48736 GHSA-38cx-cq6f-5755 Jun 15, 2026

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Medium
Network Low None None

Description

Symfony\Component\HttpClient\NoPrivateNetworkHttpClient is documented as a decorator that blocks requests to private networks by default. The list of blocked subnets (Symfony\Component\HttpFoundation\IpUtils::PRIVATE_SUBNETS on 6.4+, a private constant in NoPrivateNetworkHttpClient on 5.4) enumerates RFC1918, loopback, link-local and IPv4-mapped IPv6 (::ffff:0:0/96) prefixes, but omits the remaining IPv6 transition forms that can embed a private IPv4 destination: 6to4 (2002::/16, RFC 3056), Teredo (2001::/32, RFC 4380), NAT64 (64:ff9b::/96, RFC 6052 and 64:ff9b:1::/48, RFC 8215) and IPv4-compatible IPv6 (::/96, RFC 4291 §2.5.5.1).

IpUtils::checkIp6() is a pure bitwise CIDR comparison against the constants list and never extracts the embedded IPv4, so an attacker who can supply a URL writes the loopback / RFC1918 IPv4 target as e.g. http://[2002:7f00:1::]/ (6to4 → 127.0.0.1), http://[64:ff9b::7f00:1]/ (NAT64 → 127.0.0.1), http://[::7f00:1]/ (IPv4-compatible → 127.0.0.1) or http://[2001::1]/ (Teredo). IpUtils::isPrivateIp() returns false and NoPrivateNetworkHttpClient dispatches the request.

Real-world reachability of the embedded IPv4 depends on the deploy's IPv6 routing (6to4 tunnel interface, upstream NAT64 gateway, kernel handling of IPv4-compatible addresses), but the security boundary the decorator promises — the dispatch decision — is crossed regardless of whether the packet ultimately lands on the embedded IPv4.

Resolution

The private-subnet list now includes ::/96, 2002::/16, 2001::/32, 64:ff9b::/96 and 64:ff9b:1::/48. Blanket blocking of these prefixes matches the policy applied by Chromium and Mozilla's Private Network Access; server-side HTTPS APIs are not legitimately published on these prefixes.

The patches for this issue are available here for branch 5.4 and here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).

Credits

Symfony would like to thank tonghuaroot for reporting the issue and Nicolas Grekas for providing the fix.

Affected versions

v6.4.0v6.4.10v6.4.12v6.4.13v6.4.14v6.4.15v6.4.16v6.4.18v6.4.2v6.4.21v6.4.22v6.4.23

+ 79 more Show less

v6.4.24v6.4.25v6.4.26v6.4.28v6.4.29v6.4.3v6.4.30v6.4.31v6.4.32v6.4.33v6.4.34v6.4.35v6.4.4v6.4.7v6.4.8v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6v7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.3v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.2v7.2.3v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.10v7.3.11v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6v7.3.7v7.3.8v7.3.9v7.4.0v7.4.0-BETA1v7.4.0-BETA2v7.4.0-RC1v7.4.1v7.4.3v7.4.4v7.4.5v7.4.6v7.4.7v7.4.8v8.0.0v8.0.1v8.0.3v8.0.4v8.0.5v8.0.6v8.0.7v8.0.8

Fixed in

6.4.417.4.138.0.13

References

https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755
https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2
https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-client/CVE-2026-48736.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2026-48736.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48736.yaml

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2025-64500 GHSA-3rg7-wf37-54rm Nov 12, 2025

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

7.3 / 10
High
Network Low None None Unchanged Low Low Low

Description

The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.

Resolution

The Request class now ensures that URL paths always start with a /.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 690 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.37v2.3.38v2.3.39v2.3.4v2.3.40v2.3.41v2.3.42v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-BETA1v2.4.0-BETA2v2.4.0-RC1v2.4.1v2.4.10v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.12v2.6.13v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-BETA1v2.7.0-BETA2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.51v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.0-BETA1v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.52v2.8.6v2.8.7v2.8.8v2.8.9v3.0.0v3.0.0-BETA1v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.17v3.3.18v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-BETA1v3.4.0-BETA2v3.4.0-BETA3v3.4.0-BETA4v3.4.0-RC1v3.4.0-RC2v3.4.1v3.4.10v3.4.11v3.4.12v3.4.13v3.4.14v3.4.15v3.4.16v3.4.17v3.4.18v3.4.19v3.4.2v3.4.20v3.4.21v3.4.22v3.4.23v3.4.24v3.4.25v3.4.26v3.4.27v3.4.28v3.4.29v3.4.3v3.4.30v3.4.31v3.4.32v3.4.33v3.4.34v3.4.35v3.4.36v3.4.37v3.4.38v3.4.39v3.4.4v3.4.40v3.4.41v3.4.42v3.4.43v3.4.44v3.4.45v3.4.46v3.4.47v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.0-BETA1v4.0.0-BETA2v4.0.0-BETA3v4.0.0-BETA4v4.0.0-RC1v4.0.0-RC2v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1v4.3.0-BETA2v4.3.0-RC1v4.3.1v4.3.10v4.3.11v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.22v4.4.23v4.4.25v4.4.26v4.4.27v4.4.29v4.4.3v4.4.30v4.4.33v4.4.34v4.4.36v4.4.37v4.4.38v4.4.39v4.4.4v4.4.41v4.4.42v4.4.43v4.4.44v4.4.45v4.4.46v4.4.47v4.4.48v4.4.49v4.4.5v4.4.6v4.4.7v4.4.8v4.4.9v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.1v5.0.10v5.0.11v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.10v5.2.11v5.2.12v5.2.14v5.2.2v5.2.3v5.2.4v5.2.7v5.2.8v5.3.0v5.3.0-BETA1v5.3.0-BETA2v5.3.0-BETA3v5.3.0-RC1v5.3.1v5.3.10v5.3.11v5.3.13v5.3.14v5.3.2v5.3.3v5.3.4v5.3.6v5.3.7v5.4.0v5.4.0-BETA1v5.4.0-RC1v5.4.1v5.4.10v5.4.11v5.4.12v5.4.13v5.4.14v5.4.15v5.4.16v5.4.17v5.4.19v5.4.2v5.4.20v5.4.21v5.4.22v5.4.23v5.4.24v5.4.25v5.4.26v5.4.28v5.4.3v5.4.30v5.4.31v5.4.32v5.4.34v5.4.35v5.4.38v5.4.39v5.4.40v5.4.42v5.4.44v5.4.45v5.4.46v5.4.48v5.4.5v5.4.6v5.4.8v5.4.9v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12v6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.19v6.0.2v6.0.20v6.0.3v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.5v6.2.6v6.2.7v6.2.8v6.3.0v6.3.0-BETA1v6.3.0-BETA3v6.3.0-RC1v6.3.1v6.3.11v6.3.12v6.3.2v6.3.4v6.3.5v6.3.6v6.3.7v6.3.8v6.3.9v6.4.0v6.4.0-BETA1v6.4.0-BETA2v6.4.0-BETA3v6.4.0-RC1v6.4.0-RC2v6.4.10v6.4.12v6.4.13v6.4.14v6.4.15v6.4.16v6.4.18v6.4.2v6.4.21v6.4.22v6.4.23v6.4.24v6.4.25v6.4.26v6.4.28v6.4.3v6.4.4v6.4.7v6.4.8v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6v7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.3v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.2v7.2.3v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6

Fixed in

5.4.506.4.297.3.7

References

https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
https://nvd.nist.gov/vuln/detail/CVE-2025-64500
https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yaml
https://github.com/symfony/symfony

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-50345 GHSA-mrqx-rp3w-jpjp Nov 06, 2024

Symfony vulnerable to open redirect via browser-sanitized URLs

Low
Network Low Low None

Description

The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.

Resolution

The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 651 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.37v2.3.38v2.3.39v2.3.4v2.3.40v2.3.41v2.3.42v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-BETA1v2.4.0-BETA2v2.4.0-RC1v2.4.1v2.4.10v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.12v2.6.13v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-BETA1v2.7.0-BETA2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.51v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.0-BETA1v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.52v2.8.6v2.8.7v2.8.8v2.8.9v3.0.0v3.0.0-BETA1v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.17v3.3.18v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-BETA1v3.4.0-BETA2v3.4.0-BETA3v3.4.0-BETA4v3.4.0-RC1v3.4.0-RC2v3.4.1v3.4.10v3.4.11v3.4.12v3.4.13v3.4.14v3.4.15v3.4.16v3.4.17v3.4.18v3.4.19v3.4.2v3.4.20v3.4.21v3.4.22v3.4.23v3.4.24v3.4.25v3.4.26v3.4.27v3.4.28v3.4.29v3.4.3v3.4.30v3.4.31v3.4.32v3.4.33v3.4.34v3.4.35v3.4.36v3.4.37v3.4.38v3.4.39v3.4.4v3.4.40v3.4.41v3.4.42v3.4.43v3.4.44v3.4.45v3.4.46v3.4.47v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.0-BETA1v4.0.0-BETA2v4.0.0-BETA3v4.0.0-BETA4v4.0.0-RC1v4.0.0-RC2v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1v4.3.0-BETA2v4.3.0-RC1v4.3.1v4.3.10v4.3.11v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.22v4.4.23v4.4.25v4.4.26v4.4.27v4.4.29v4.4.3v4.4.30v4.4.33v4.4.34v4.4.36v4.4.37v4.4.38v4.4.39v4.4.4v4.4.41v4.4.42v4.4.43v4.4.44v4.4.45v4.4.46v4.4.47v4.4.48v4.4.49v4.4.5v4.4.6v4.4.7v4.4.8v4.4.9v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.1v5.0.10v5.0.11v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.10v5.2.11v5.2.12v5.2.14v5.2.2v5.2.3v5.2.4v5.2.7v5.2.8v5.3.0v5.3.0-BETA1v5.3.0-BETA2v5.3.0-BETA3v5.3.0-RC1v5.3.1v5.3.10v5.3.11v5.3.13v5.3.14v5.3.2v5.3.3v5.3.4v5.3.6v5.3.7v5.4.0v5.4.0-BETA1v5.4.0-RC1v5.4.1v5.4.10v5.4.11v5.4.12v5.4.13v5.4.14v5.4.15v5.4.16v5.4.17v5.4.19v5.4.2v5.4.20v5.4.21v5.4.22v5.4.23v5.4.24v5.4.25v5.4.26v5.4.28v5.4.3v5.4.30v5.4.31v5.4.32v5.4.34v5.4.35v5.4.38v5.4.39v5.4.40v5.4.42v5.4.44v5.4.45v5.4.5v5.4.6v5.4.8v5.4.9v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12v6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.19v6.0.2v6.0.20v6.0.3v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.5v6.2.6v6.2.7v6.2.8v6.3.0v6.3.0-BETA1v6.3.0-BETA3v6.3.0-RC1v6.3.1v6.3.11v6.3.12v6.3.2v6.3.4v6.3.5v6.3.6v6.3.7v6.3.8v6.3.9v6.4.0v6.4.0-BETA1v6.4.0-BETA2v6.4.0-BETA3v6.4.0-RC1v6.4.0-RC2v6.4.10v6.4.12v6.4.13v6.4.2v6.4.3v6.4.4v6.4.7v6.4.8v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6v7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.3v7.1.5v7.1.6

Fixed in

5.4.466.4.147.1.7

References

https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp
https://nvd.nist.gov/vuln/detail/CVE-2024-50345
https://github.com/symfony/symfony/commit/5a9b08e5740af795854b1b639b7d45b9cbfe8819
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2024-50345.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50345.yaml
https://github.com/symfony/symfony

Updated Nov 03, 2025 · Source: OSV.dev
CVE-2015-2309 GHSA-p684-f7fh-jv2j May 30, 2024

Symfony has unsafe methods in the Request class

5.3 / 10
Medium
Network Low None None Unchanged None Low None

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintained anymore.

Description

The Symfony\Component\HttpFoundation\Request class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middle attack between the latest trusted proxy and the web server.

The following methods are impacted: getPort(), isSecure(), and getHost(), and getClientIps().

Resolution

All impacted methods now check that the remote address is trusted, which fixes the issue.

The patch for this issue is available here.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 92 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5

Fixed in

2.3.272.5.112.6.6

References

https://github.com/symfony/symfony/pull/14166
https://github.com/symfony/symfony/commit/6c73f0ce9302a0091bbfbb96f317e400ce16ef84
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2015-2309.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-2309.yaml
https://symfony.com/cve-2015-2309

Updated May 30, 2024 · Source: OSV.dev
CVE-2014-6061 GHSA-h7v2-2qwg-h829 May 30, 2024

Symfony has a security issue when parsing the Authorization header

5.3 / 10
Medium
Network Low None None Unchanged None Low None

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.

Description

When an application uses an HTTP basic or digest authentication, Symfony does not parse the Authorization header properly, which could be exploited in some server setups (no exploits have been demonstrated though.)

Resolution

The parsing of the Authorization header has been fixed to comply to the HTTP specification.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11829

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 66 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.5.0v2.5.1v2.5.2v2.5.3

Fixed in

2.3.192.4.92.5.4

References

https://github.com/symfony/symfony/pull/11829
https://github.com/symfony/symfony/commit/3b4046e89467dc1fb5e079e377c2cfd4c239f904
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-6061.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-6061.yaml
https://symfony.com/cve-2014-6061

Updated May 30, 2024 · Source: OSV.dev
CVE-2014-5244 GHSA-v77v-x634-9m56 May 30, 2024

Symfony vulnerable to denial of service via a malicious HTTP Host header

7.5 / 10
High
Network Low None None Unchanged None None High

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.

Description When an arbitrarily long hostname is sent by a client, its parsing in Request::getHost() can lead to a DoS attack, due to the way we validate the hostname via a regular expression.

Resolution The regular expression used to parse and validate the hostname from the HTTP request has been modified to avoid too much sensitivity to the submitted value length.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11828

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 66 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.5.0v2.5.1v2.5.2v2.5.3

Fixed in

2.3.192.4.92.5.4

References

https://github.com/symfony/symfony/pull/11828
https://github.com/symfony/symfony/commit/1ee96a8b1b0987ffe2a62dca7ad268bf9edfa9b8
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-5244.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-5244.yaml
https://symfony.com/blog/cve-2014-5244-denial-of-service-with-a-malicious-http-host-header
https://symfony.com/cve-2014-5244

Updated May 30, 2024 · Source: OSV.dev
GHSA-vfm6-r2gc-pwww May 30, 2024

Symfony2 security issue when the trust proxy mode is enabled

Medium

An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control.

To fix this security issue, the following changes have been made to all versions of Symfony2:

A new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP addresses as its argument:

// before (probably in your front controller script) Request::trustProxyData(); // after Request::setTrustedProxies(array('1.1.1.1')); // 1.1.1.1 being the IP address of a trusted reverse proxy

The Request::trustProxyData() method has been deprecated (when used, it automatically trusts the latest proxy in the chain -- which is the current remote address):

Request::trustProxyData(); // is equivalent to Request::setTrustedProxies(array($request->server->get('REMOTE_ADDR')));

We encourage all Symfony2 users to upgrade as soon as possible. It you don't want to upgrade to the latest version yet, you can also apply the following patches:

Patch for Symfony 2.0.19

Patch for Symfony 2.1.4

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 5 more Show less

v2.0.9v2.1.0v2.1.1v2.1.2v2.1.3

Fixed in

2.0.192.1.4

References

https://github.com/symfony/http-foundation/commit/5cde5229fc71a19cef2a0a933a18e08e43252f34
https://github.com/symfony/http-foundation/commit/795ac45c188ee2a729db4513e9dfd30b16a0ed35
https://github.com/symfony/symfony/commit/9ce892cf4395e73b136e9b5cd1fae9e91995c93b
https://github.com/symfony/symfony/commit/e5536f0fe10421da7ebbe0071343e94d039dfb97
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/2012-11-29.yaml
https://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4

Updated Dec 04, 2024 · Source: OSV.dev
CVE-2012-6431 GHSA-83c3-qx27-2rwr May 17, 2022

Symfony Allows URI Restrictions Bypass Via Double-Encoded String

Medium

On the Symfony 2.0.x version, there's a security issue that allows access to routes protected by a firewall even when the user is not logged in.

Both the Routing component and the Security component uses the path returned by getPathInfo() to match a Request. The getPathInfo() returns a decoded path, but the Routing component (Symfony\Component\Routing\Matcher\UrlMatcher) decodes the path a second time; whereas the Security component, Symfony\Component\HttpFoundation\RequestMatcher, does not.

This difference causes Symfony 2.0 to be vulnerable to double encoding attacks.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 1 more Show less

v2.0.9

Fixed in

2.0.19

References

https://nvd.nist.gov/vuln/detail/CVE-2012-6431
https://github.com/symfony/symfony/commit/55014a6841bec50046e8329a4835c160ac31a496
https://github.com/symfony/symfony/commit/8b2c17f80377582287a78e0b521497e039dd6b0d
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2012-6431.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/routing/CVE-2012-6431.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2012-6431.yaml

Updated Dec 03, 2024 · Source: OSV.dev
CVE-2018-11386 GHSA-r2rq-3h56-fqm4 May 14, 2022

Symfony DoS

5.9 / 10
Medium
Network High None None Unchanged None None High

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

Affected versions

v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19

+ 116 more Show less

v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9v3.3.0v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9

Fixed in

2.7.482.8.413.3.173.4.114.0.11

References

https://nvd.nist.gov/vuln/detail/CVE-2018-11386
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11386.yaml
https://github.com/symfony/symfony
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW

Updated Feb 17, 2024 · Source: OSV.dev
CVE-2018-14773 GHSA-8wgj-6wx8-h5hq May 13, 2022

Symfony HTTP Foundation web cache poisoning

6.5 / 10
Medium
Network Low Low None Unchanged None High None

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.

Affected versions

v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19

+ 173 more Show less

v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.17v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12v3.4.13v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.2

Fixed in

2.7.492.8.443.3.183.4.144.0.144.1.3

References

https://nvd.nist.gov/vuln/detail/CVE-2018-14773
https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-14773.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-14773.yaml
https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
https://seclists.org/bugtraq/2019/May/21

Updated Feb 16, 2024 · Source: OSV.dev

1–10 of 14

Insights

Releases per month

last 12 months

Release mix

major 6
minor 29
patch 576
pre 77

689 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More