symfony/http-foundation

Defines an object-oriented layer for the HTTP specification

View on Packagist

View on Github

Activity

Latest release: 3d ago
Total releases: 702
Cadence: ~daily
Last 12 months: 69

Reach

Stars: 8.6k

Details

License: MIT
First release: Sep 29, 2011

Releases

Version	Released
`v7.4.22` patch	Oct 27, 2026
`v8.1.10` patch	Oct 27, 2026
`v6.4.49` patch	Oct 25, 2026
`v8.1.9` patch	Oct 08, 2026
`v7.4.21` patch	Oct 08, 2026
`v6.4.48` patch	Oct 08, 2026
`v5.4.54` patch	Sep 30, 2026
`v8.1.8` patch	Sep 24, 2026
`v7.4.20` patch	Sep 24, 2026
`v6.4.47` patch	Sep 24, 2026
`v8.1.7` patch	Sep 14, 2026
`v7.4.19` patch	Sep 14, 2026
`v6.4.46` patch	Sep 14, 2026
`v8.1.6` patch 1 CVE	Aug 30, 2026
`v7.4.18` patch 1 CVE	Aug 30, 2026
`v6.4.45` patch 1 CVE	Aug 30, 2026
`v8.1.5` patch 1 CVE	Aug 20, 2026
`v7.4.17` patch 1 CVE	Aug 20, 2026
`v6.4.44` patch 1 CVE	Aug 20, 2026
`v8.1.4` patch 1 CVE	Aug 07, 2026
`v7.4.16` patch 1 CVE	Aug 07, 2026
`v8.1.2` patch 1 CVE	Jul 29, 2026
`v8.0.15` patch 1 CVE	Jul 29, 2026
`v7.4.15` patch 1 CVE	Jul 29, 2026
`v6.4.43` patch 1 CVE	Jul 29, 2026
`v6.4.42` patch 1 CVE	Jun 16, 2026
`v8.1.1` patch 1 CVE	Jun 12, 2026
`v8.0.14` patch 1 CVE	Jun 12, 2026
`v7.4.14` patch 1 CVE	Jun 11, 2026
`v8.1.0` minor 1 CVE	May 29, 2026
`v8.1.0-RC1` pre 1 CVE	May 24, 2026
`v8.0.13` patch 1 CVE	May 24, 2026
`v7.4.13` patch 1 CVE	May 24, 2026
`v6.4.41` patch 1 CVE	May 24, 2026
`v8.1.0-BETA3` pre 1 CVE	May 19, 2026
`v8.1.0-BETA1` pre 1 CVE	May 05, 2026
`v8.0.8` patch 2 CVEs	Mar 30, 2026
`v7.4.8` patch 2 CVEs	Mar 24, 2026
`v8.0.7` patch 2 CVEs	Mar 06, 2026
`v7.4.7` patch 2 CVEs	Mar 06, 2026
`v6.4.35` patch 2 CVEs	Mar 06, 2026
`v8.0.6` patch 2 CVEs	Feb 21, 2026
`v7.4.6` patch 2 CVEs	Feb 21, 2026
`v6.4.34` patch 2 CVEs	Feb 21, 2026
`v8.0.5` patch 2 CVEs	Jan 27, 2026
`v7.4.5` patch 2 CVEs	Jan 27, 2026
`v7.3.11` patch 2 CVEs	Jan 27, 2026
`v6.4.33` patch 2 CVEs	Jan 27, 2026
`v8.0.4` patch 2 CVEs	Jan 09, 2026
`v7.4.4` patch 2 CVEs	Jan 09, 2026

1–50 of 702

Repository

symfony/http-foundation

Forks: 307
Open issues: 0
Language: PHP
: 4.5/ 10

php
symfony
component
symfony-component

Dependencies (2)

Depends on

v7.4.22

Used by

5704

Supply-chain exposure

5,704 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (15)

CVE-2026-108082 GHSA-r925-mgvr-h9cc Oct 27, 2026

Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

High
Network Low None None

Description

HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.

A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.

Resolution

The pattern now consumes whitespace only when more of the value follows it, so a value can no longer end on whitespace, nothing has to be given back, and every quantifier is possessive. The first release of this fix broke splitting on a whitespace separator: HeaderUtils::split('foo bar', ' ') returned a single value in 6.4.46 to 6.4.47, 7.4.19 to 7.4.20 and 8.1.7 to 8.1.8. Whitespace characters used as separators are now left out of the whitespace branch, which 6.4.48, 7.4.21 and 8.1.9 contain.

The patches for this issue are available here for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2).

Credits

Symfony would like to thank r3verii for reporting the issue and Nicolas Grekas for providing the fix.

Symfony would also like to thank Bruno Dias from Checkmarx for his help getting a CVE assigned.

Affected versions

v6.0.1v6.0.10v6.0.11v6.0.12v6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.19v6.0.2v6.0.20

+ 360 more Show less

v6.0.3v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.5v6.2.6v6.2.7v6.2.8v6.3.0v6.3.0-BETA1v6.3.0-BETA3v6.3.0-RC1v6.3.1v6.3.11v6.3.12v6.3.2v6.3.4v6.3.5v6.3.6v6.3.7v6.3.8v6.3.9v6.4.0v6.4.0-BETA1v6.4.0-BETA2v6.4.0-BETA3v6.4.0-RC1v6.4.0-RC2v6.4.10v6.4.12v6.4.13v6.4.14v6.4.15v6.4.16v6.4.18v6.4.2v6.4.21v6.4.22v6.4.23v6.4.24v6.4.25v6.4.26v6.4.28v6.4.29v6.4.3v6.4.30v6.4.31v6.4.32v6.4.33v6.4.34v6.4.35v6.4.4v6.4.41v6.4.42v6.4.43v6.4.44v6.4.45v6.4.7v6.4.8v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6v7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.3v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.2v7.2.3v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.10v7.3.11v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6v7.3.7v7.3.8v7.3.9v7.4.0v7.4.0-BETA1v7.4.0-BETA2v7.4.0-RC1v7.4.1v7.4.13v7.4.14v7.4.15v7.4.16v7.4.17v7.4.18v7.4.3v7.4.4v7.4.5v7.4.6v7.4.7v7.4.8v8.0.0v8.0.1v8.0.13v8.0.14v8.0.15v8.0.3v8.0.4v8.0.5v8.0.6v8.0.7v8.0.8v8.1.0v8.1.0-BETA1v8.1.0-BETA3v8.1.0-RC1v8.1.1v8.1.2v8.1.4v8.1.5v8.1.6v4.1.0v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1v4.3.0-BETA2v4.3.0-RC1v4.3.1v4.3.10v4.3.11v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.22v4.4.23v4.4.25v4.4.26v4.4.27v4.4.29v4.4.3v4.4.30v4.4.33v4.4.34v4.4.36v4.4.37v4.4.38v4.4.39v4.4.4v4.4.41v4.4.42v4.4.43v4.4.44v4.4.45v4.4.46v4.4.47v4.4.48v4.4.49v4.4.5v4.4.6v4.4.7v4.4.8v4.4.9v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.1v5.0.10v5.0.11v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.10v5.2.11v5.2.12v5.2.14v5.2.2v5.2.3v5.2.4v5.2.7v5.2.8v5.3.0v5.3.0-BETA1v5.3.0-BETA2v5.3.0-BETA3v5.3.0-RC1v5.3.1v5.3.10v5.3.11v5.3.13v5.3.14v5.3.2v5.3.3v5.3.4v5.3.6v5.3.7v5.4.0v5.4.0-BETA1v5.4.0-RC1v5.4.1v5.4.10v5.4.11v5.4.12v5.4.13v5.4.14v5.4.15v5.4.16v5.4.17v5.4.19v5.4.2v5.4.20v5.4.21v5.4.22v5.4.23v5.4.24v5.4.25v5.4.26v5.4.28v5.4.3v5.4.30v5.4.31v5.4.32v5.4.34v5.4.35v5.4.38v5.4.39v5.4.40v5.4.42v5.4.44v5.4.45v5.4.46v5.4.48v5.4.5v5.4.50v5.4.6v5.4.8v5.4.9

Fixed in

5.4.546.4.467.4.198.1.7

References

https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc
https://nvd.nist.gov/vuln/detail/CVE-2026-108082
https://github.com/symfony/symfony/pull/66048
https://github.com/symfony/symfony/pull/66491
https://github.com/symfony/symfony/commit/343a1772ce6ac03e48b228d2d7168d19750e3f36
https://github.com/symfony/symfony/commit/9ffa802e5d7e9fb8ba95eeefd27e863e83b1baca

Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-48736 GHSA-38cx-cq6f-5755 Jun 15, 2026

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Medium
Network Low None None

Description

Symfony\Component\HttpClient\NoPrivateNetworkHttpClient is documented as a decorator that blocks requests to private networks by default. The list of blocked subnets (Symfony\Component\HttpFoundation\IpUtils::PRIVATE_SUBNETS on 6.4+, a private constant in NoPrivateNetworkHttpClient on 5.4) enumerates RFC1918, loopback, link-local and IPv4-mapped IPv6 (::ffff:0:0/96) prefixes, but omits the remaining IPv6 transition forms that can embed a private IPv4 destination: 6to4 (2002::/16, RFC 3056), Teredo (2001::/32, RFC 4380), NAT64 (64:ff9b::/96, RFC 6052 and 64:ff9b:1::/48, RFC 8215) and IPv4-compatible IPv6 (::/96, RFC 4291 §2.5.5.1).

IpUtils::checkIp6() is a pure bitwise CIDR comparison against the constants list and never extracts the embedded IPv4, so an attacker who can supply a URL writes the loopback / RFC1918 IPv4 target as e.g. http://[2002:7f00:1::]/ (6to4 → 127.0.0.1), http://[64:ff9b::7f00:1]/ (NAT64 → 127.0.0.1), http://[::7f00:1]/ (IPv4-compatible → 127.0.0.1) or http://[2001::1]/ (Teredo). IpUtils::isPrivateIp() returns false and NoPrivateNetworkHttpClient dispatches the request.

Real-world reachability of the embedded IPv4 depends on the deploy's IPv6 routing (6to4 tunnel interface, upstream NAT64 gateway, kernel handling of IPv4-compatible addresses), but the security boundary the decorator promises — the dispatch decision — is crossed regardless of whether the packet ultimately lands on the embedded IPv4.

Resolution

The private-subnet list now includes ::/96, 2002::/16, 2001::/32, 64:ff9b::/96 and 64:ff9b:1::/48. Blanket blocking of these prefixes matches the policy applied by Chromium and Mozilla's Private Network Access; server-side HTTPS APIs are not legitimately published on these prefixes.

The patches for this issue are available here for branch 5.4 and here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).

Credits

Symfony would like to thank tonghuaroot for reporting the issue and Nicolas Grekas for providing the fix.

Affected versions

v6.4.0v6.4.10v6.4.12v6.4.13v6.4.14v6.4.15v6.4.16v6.4.18v6.4.2v6.4.21v6.4.22v6.4.23

+ 79 more Show less

v6.4.24v6.4.25v6.4.26v6.4.28v6.4.29v6.4.3v6.4.30v6.4.31v6.4.32v6.4.33v6.4.34v6.4.35v6.4.4v6.4.7v6.4.8v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6v7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.3v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.2v7.2.3v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.10v7.3.11v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6v7.3.7v7.3.8v7.3.9v7.4.0v7.4.0-BETA1v7.4.0-BETA2v7.4.0-RC1v7.4.1v7.4.3v7.4.4v7.4.5v7.4.6v7.4.7v7.4.8v8.0.0v8.0.1v8.0.3v8.0.4v8.0.5v8.0.6v8.0.7v8.0.8

Fixed in

6.4.417.4.138.0.13

References

https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755
https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2
https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-client/CVE-2026-48736.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2026-48736.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48736.yaml

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2025-64500 GHSA-3rg7-wf37-54rm Nov 12, 2025

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

7.3 / 10
High
Network Low None None Unchanged Low Low Low

Description

The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.

Resolution

The Request class now ensures that URL paths always start with a /.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 690 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.37v2.3.38v2.3.39v2.3.4v2.3.40v2.3.41v2.3.42v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-BETA1v2.4.0-BETA2v2.4.0-RC1v2.4.1v2.4.10v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.12v2.6.13v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-BETA1v2.7.0-BETA2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.51v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.0-BETA1v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.52v2.8.6v2.8.7v2.8.8v2.8.9v3.0.0v3.0.0-BETA1v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.17v3.3.18v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-BETA1v3.4.0-BETA2v3.4.0-BETA3v3.4.0-BETA4v3.4.0-RC1v3.4.0-RC2v3.4.1v3.4.10v3.4.11v3.4.12v3.4.13v3.4.14v3.4.15v3.4.16v3.4.17v3.4.18v3.4.19v3.4.2v3.4.20v3.4.21v3.4.22v3.4.23v3.4.24v3.4.25v3.4.26v3.4.27v3.4.28v3.4.29v3.4.3v3.4.30v3.4.31v3.4.32v3.4.33v3.4.34v3.4.35v3.4.36v3.4.37v3.4.38v3.4.39v3.4.4v3.4.40v3.4.41v3.4.42v3.4.43v3.4.44v3.4.45v3.4.46v3.4.47v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.0-BETA1v4.0.0-BETA2v4.0.0-BETA3v4.0.0-BETA4v4.0.0-RC1v4.0.0-RC2v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1v4.3.0-BETA2v4.3.0-RC1v4.3.1v4.3.10v4.3.11v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.22v4.4.23v4.4.25v4.4.26v4.4.27v4.4.29v4.4.3v4.4.30v4.4.33v4.4.34v4.4.36v4.4.37v4.4.38v4.4.39v4.4.4v4.4.41v4.4.42v4.4.43v4.4.44v4.4.45v4.4.46v4.4.47v4.4.48v4.4.49v4.4.5v4.4.6v4.4.7v4.4.8v4.4.9v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.1v5.0.10v5.0.11v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.10v5.2.11v5.2.12v5.2.14v5.2.2v5.2.3v5.2.4v5.2.7v5.2.8v5.3.0v5.3.0-BETA1v5.3.0-BETA2v5.3.0-BETA3v5.3.0-RC1v5.3.1v5.3.10v5.3.11v5.3.13v5.3.14v5.3.2v5.3.3v5.3.4v5.3.6v5.3.7v5.4.0v5.4.0-BETA1v5.4.0-RC1v5.4.1v5.4.10v5.4.11v5.4.12v5.4.13v5.4.14v5.4.15v5.4.16v5.4.17v5.4.19v5.4.2v5.4.20v5.4.21v5.4.22v5.4.23v5.4.24v5.4.25v5.4.26v5.4.28v5.4.3v5.4.30v5.4.31v5.4.32v5.4.34v5.4.35v5.4.38v5.4.39v5.4.40v5.4.42v5.4.44v5.4.45v5.4.46v5.4.48v5.4.5v5.4.6v5.4.8v5.4.9v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12v6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.19v6.0.2v6.0.20v6.0.3v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.5v6.2.6v6.2.7v6.2.8v6.3.0v6.3.0-BETA1v6.3.0-BETA3v6.3.0-RC1v6.3.1v6.3.11v6.3.12v6.3.2v6.3.4v6.3.5v6.3.6v6.3.7v6.3.8v6.3.9v6.4.0v6.4.0-BETA1v6.4.0-BETA2v6.4.0-BETA3v6.4.0-RC1v6.4.0-RC2v6.4.10v6.4.12v6.4.13v6.4.14v6.4.15v6.4.16v6.4.18v6.4.2v6.4.21v6.4.22v6.4.23v6.4.24v6.4.25v6.4.26v6.4.28v6.4.3v6.4.4v6.4.7v6.4.8v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6v7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.3v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.2v7.2.3v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6

Fixed in

5.4.506.4.297.3.7

References

https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
https://nvd.nist.gov/vuln/detail/CVE-2025-64500
https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yaml
https://github.com/symfony/symfony

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-50345 GHSA-mrqx-rp3w-jpjp Nov 06, 2024

Symfony vulnerable to open redirect via browser-sanitized URLs

Low
Network Low Low None

Description

The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.

Resolution

The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 651 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.37v2.3.38v2.3.39v2.3.4v2.3.40v2.3.41v2.3.42v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-BETA1v2.4.0-BETA2v2.4.0-RC1v2.4.1v2.4.10v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.12v2.6.13v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-BETA1v2.7.0-BETA2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.51v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.0-BETA1v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.52v2.8.6v2.8.7v2.8.8v2.8.9v3.0.0v3.0.0-BETA1v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.17v3.3.18v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-BETA1v3.4.0-BETA2v3.4.0-BETA3v3.4.0-BETA4v3.4.0-RC1v3.4.0-RC2v3.4.1v3.4.10v3.4.11v3.4.12v3.4.13v3.4.14v3.4.15v3.4.16v3.4.17v3.4.18v3.4.19v3.4.2v3.4.20v3.4.21v3.4.22v3.4.23v3.4.24v3.4.25v3.4.26v3.4.27v3.4.28v3.4.29v3.4.3v3.4.30v3.4.31v3.4.32v3.4.33v3.4.34v3.4.35v3.4.36v3.4.37v3.4.38v3.4.39v3.4.4v3.4.40v3.4.41v3.4.42v3.4.43v3.4.44v3.4.45v3.4.46v3.4.47v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.0-BETA1v4.0.0-BETA2v4.0.0-BETA3v4.0.0-BETA4v4.0.0-RC1v4.0.0-RC2v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1v4.3.0-BETA2v4.3.0-RC1v4.3.1v4.3.10v4.3.11v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.22v4.4.23v4.4.25v4.4.26v4.4.27v4.4.29v4.4.3v4.4.30v4.4.33v4.4.34v4.4.36v4.4.37v4.4.38v4.4.39v4.4.4v4.4.41v4.4.42v4.4.43v4.4.44v4.4.45v4.4.46v4.4.47v4.4.48v4.4.49v4.4.5v4.4.6v4.4.7v4.4.8v4.4.9v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.1v5.0.10v5.0.11v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.10v5.2.11v5.2.12v5.2.14v5.2.2v5.2.3v5.2.4v5.2.7v5.2.8v5.3.0v5.3.0-BETA1v5.3.0-BETA2v5.3.0-BETA3v5.3.0-RC1v5.3.1v5.3.10v5.3.11v5.3.13v5.3.14v5.3.2v5.3.3v5.3.4v5.3.6v5.3.7v5.4.0v5.4.0-BETA1v5.4.0-RC1v5.4.1v5.4.10v5.4.11v5.4.12v5.4.13v5.4.14v5.4.15v5.4.16v5.4.17v5.4.19v5.4.2v5.4.20v5.4.21v5.4.22v5.4.23v5.4.24v5.4.25v5.4.26v5.4.28v5.4.3v5.4.30v5.4.31v5.4.32v5.4.34v5.4.35v5.4.38v5.4.39v5.4.40v5.4.42v5.4.44v5.4.45v5.4.5v5.4.6v5.4.8v5.4.9v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12v6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.19v6.0.2v6.0.20v6.0.3v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.5v6.2.6v6.2.7v6.2.8v6.3.0v6.3.0-BETA1v6.3.0-BETA3v6.3.0-RC1v6.3.1v6.3.11v6.3.12v6.3.2v6.3.4v6.3.5v6.3.6v6.3.7v6.3.8v6.3.9v6.4.0v6.4.0-BETA1v6.4.0-BETA2v6.4.0-BETA3v6.4.0-RC1v6.4.0-RC2v6.4.10v6.4.12v6.4.13v6.4.2v6.4.3v6.4.4v6.4.7v6.4.8v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6v7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.3v7.1.5v7.1.6

Fixed in

5.4.466.4.147.1.7

References

https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp
https://nvd.nist.gov/vuln/detail/CVE-2024-50345
https://github.com/symfony/symfony/commit/5a9b08e5740af795854b1b639b7d45b9cbfe8819
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2024-50345.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50345.yaml
https://github.com/symfony/symfony

Updated Nov 03, 2025 · Source: OSV.dev
CVE-2015-2309 GHSA-p684-f7fh-jv2j May 30, 2024

Symfony has unsafe methods in the Request class

5.3 / 10
Medium
Network Low None None Unchanged None Low None

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintained anymore.

Description

The Symfony\Component\HttpFoundation\Request class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middle attack between the latest trusted proxy and the web server.

The following methods are impacted: getPort(), isSecure(), and getHost(), and getClientIps().

Resolution

All impacted methods now check that the remote address is trusted, which fixes the issue.

The patch for this issue is available here.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 92 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5

Fixed in

2.3.272.5.112.6.6

References

https://github.com/symfony/symfony/pull/14166
https://github.com/symfony/symfony/commit/6c73f0ce9302a0091bbfbb96f317e400ce16ef84
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2015-2309.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-2309.yaml
https://symfony.com/cve-2015-2309

Updated May 30, 2024 · Source: OSV.dev
CVE-2014-6061 GHSA-h7v2-2qwg-h829 May 30, 2024

Symfony has a security issue when parsing the Authorization header

5.3 / 10
Medium
Network Low None None Unchanged None Low None

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.

Description

When an application uses an HTTP basic or digest authentication, Symfony does not parse the Authorization header properly, which could be exploited in some server setups (no exploits have been demonstrated though.)

Resolution

The parsing of the Authorization header has been fixed to comply to the HTTP specification.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11829

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 66 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.5.0v2.5.1v2.5.2v2.5.3

Fixed in

2.3.192.4.92.5.4

References

https://github.com/symfony/symfony/pull/11829
https://github.com/symfony/symfony/commit/3b4046e89467dc1fb5e079e377c2cfd4c239f904
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-6061.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-6061.yaml
https://symfony.com/cve-2014-6061

Updated May 30, 2024 · Source: OSV.dev
CVE-2014-5244 GHSA-v77v-x634-9m56 May 30, 2024

Symfony vulnerable to denial of service via a malicious HTTP Host header

7.5 / 10
High
Network Low None None Unchanged None None High

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.

Description When an arbitrarily long hostname is sent by a client, its parsing in Request::getHost() can lead to a DoS attack, due to the way we validate the hostname via a regular expression.

Resolution The regular expression used to parse and validate the hostname from the HTTP request has been modified to avoid too much sensitivity to the submitted value length.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11828

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 66 more Show less

v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.5.0v2.5.1v2.5.2v2.5.3

Fixed in

2.3.192.4.92.5.4

References

https://github.com/symfony/symfony/pull/11828
https://github.com/symfony/symfony/commit/1ee96a8b1b0987ffe2a62dca7ad268bf9edfa9b8
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-5244.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-5244.yaml
https://symfony.com/blog/cve-2014-5244-denial-of-service-with-a-malicious-http-host-header
https://symfony.com/cve-2014-5244

Updated May 30, 2024 · Source: OSV.dev
GHSA-vfm6-r2gc-pwww May 30, 2024

Symfony2 security issue when the trust proxy mode is enabled

Medium

An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control.

To fix this security issue, the following changes have been made to all versions of Symfony2:

A new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP addresses as its argument:

// before (probably in your front controller script) Request::trustProxyData(); // after Request::setTrustedProxies(array('1.1.1.1')); // 1.1.1.1 being the IP address of a trusted reverse proxy

The Request::trustProxyData() method has been deprecated (when used, it automatically trusts the latest proxy in the chain -- which is the current remote address):

Request::trustProxyData(); // is equivalent to Request::setTrustedProxies(array($request->server->get('REMOTE_ADDR')));

We encourage all Symfony2 users to upgrade as soon as possible. It you don't want to upgrade to the latest version yet, you can also apply the following patches:

Patch for Symfony 2.0.19

Patch for Symfony 2.1.4

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 5 more Show less

v2.0.9v2.1.0v2.1.1v2.1.2v2.1.3

Fixed in

2.0.192.1.4

References

https://github.com/symfony/http-foundation/commit/5cde5229fc71a19cef2a0a933a18e08e43252f34
https://github.com/symfony/http-foundation/commit/795ac45c188ee2a729db4513e9dfd30b16a0ed35
https://github.com/symfony/symfony/commit/9ce892cf4395e73b136e9b5cd1fae9e91995c93b
https://github.com/symfony/symfony/commit/e5536f0fe10421da7ebbe0071343e94d039dfb97
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/2012-11-29.yaml
https://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4

Updated Dec 04, 2024 · Source: OSV.dev
CVE-2012-6431 GHSA-83c3-qx27-2rwr May 17, 2022

Symfony Allows URI Restrictions Bypass Via Double-Encoded String

Medium

On the Symfony 2.0.x version, there's a security issue that allows access to routes protected by a firewall even when the user is not logged in.

Both the Routing component and the Security component uses the path returned by getPathInfo() to match a Request. The getPathInfo() returns a decoded path, but the Routing component (Symfony\Component\Routing\Matcher\UrlMatcher) decodes the path a second time; whereas the Security component, Symfony\Component\HttpFoundation\RequestMatcher, does not.

This difference causes Symfony 2.0 to be vulnerable to double encoding attacks.

Affected versions

2.0.42.0.52.0.62.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18

+ 1 more Show less

v2.0.9

Fixed in

2.0.19

References

https://nvd.nist.gov/vuln/detail/CVE-2012-6431
https://github.com/symfony/symfony/commit/55014a6841bec50046e8329a4835c160ac31a496
https://github.com/symfony/symfony/commit/8b2c17f80377582287a78e0b521497e039dd6b0d
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2012-6431.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/routing/CVE-2012-6431.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2012-6431.yaml

Updated Dec 03, 2024 · Source: OSV.dev
CVE-2018-11386 GHSA-r2rq-3h56-fqm4 May 14, 2022

Symfony DoS

5.9 / 10
Medium
Network High None None Unchanged None None High

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

Affected versions

v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19

+ 116 more Show less

v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9v3.3.0v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9

Fixed in

2.7.482.8.413.3.173.4.114.0.11

References

https://nvd.nist.gov/vuln/detail/CVE-2018-11386
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11386.yaml
https://github.com/symfony/symfony
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW

Updated Feb 17, 2024 · Source: OSV.dev

1–10 of 15

Insights

Releases per month

last 12 months

Release mix

major 6
minor 29
patch 589
pre 77

702 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More