p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in symfony/http-foundation

In den letzten 30 Tagen veröffentlichte Sicherheitslücke für symfony/http-foundation: 1. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 15

  1. CVE-2026-108082

    Hoch · CVSS 8.7EPSS 0,48%Korrektur verfügbar

    Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 5.4.54 aktualisieren
    • Auf 6.4.46 aktualisieren
    • Auf 7.4.19 aktualisieren
    • Auf 8.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-48736

    Mittel · CVSS 6.9EPSS 0,57%Korrektur verfügbar

    Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 6.4.41 aktualisieren
    • Auf 7.4.13 aktualisieren
    • Auf 8.0.13 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2025-64500

    Hoch · CVSS 7.3EPSS 1,41%Öffentlicher ExploitKorrektur verfügbar

    Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 5.4.50 aktualisieren
    • Auf 6.4.29 aktualisieren
    • Auf 7.3.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2024-50345

    Niedrig · CVSS 3.1EPSS 0,59%Korrektur verfügbar

    Open redirect via browser-sanitized URLs in symfony/http-foundation

    symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 5.4.46 aktualisieren
    • Auf 6.4.14 aktualisieren
    • Auf 7.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2015-2309

    Mittel · CVSS 5.3Korrektur verfügbar

    Symfony has unsafe methods in the Request class

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintained anymore. ### Description The Symfony\Component\HttpFoundation\Request class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middl

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.3.27 aktualisieren
    • Auf 2.5.11 aktualisieren
    • Auf 2.6.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2014-6061

    Mittel · CVSS 5.3Korrektur verfügbar

    Symfony has a security issue when parsing the Authorization header

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore. ### Description When an application uses an HTTP basic or digest authentication, Symfony does not parse the `Authorization` header properly, which could be exploited in some server setups (no exploits have been demonstrated though.) ### Resolution The parsing of the `Authorization` header has been fixed to comply to the HTTP specification. The patc

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.3.19 aktualisieren
    • Auf 2.4.9 aktualisieren
    • Auf 2.5.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2014-5244

    Hoch · CVSS 7.5Korrektur verfügbar

    Symfony vulnerable to denial of service via a malicious HTTP Host header

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore. Description When an arbitrarily long hostname is sent by a client, its parsing in `Request::getHost()` can lead to a DoS attack, due to the way we validate the hostname via a regular expression. Resolution The regular expression used to parse and validate the hostname from the HTTP request has been modified to avoid too much sensitivity to the submi

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.3.19 aktualisieren
    • Auf 2.4.9 aktualisieren
    • Auf 2.5.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. GHSA-vfm6-r2gc-pwww

    Nicht bewertetKorrektur verfügbar

    Symfony2 security issue when the trust proxy mode is enabled

    An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control. To fix this security issue, the following changes have been made to all versions of Symfony2: A new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP addresses as its argument: ``` // before (probably in your front controller script) Request::trustProxyData(); // after Request::setTrustedProxies(array('1.1.1.1')); // 1.1.1.1 being the IP address of

    symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.0.19 aktualisieren
    • Auf 2.1.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2020-5255

    Niedrig · CVSS 2.6EPSS 1,3%Korrektur verfügbar

    Prevent cache poisoning via a Response Content-Type header

    In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response&#39;s content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

    symfony/http-foundation symfony/http-foundationPHP
    • Auf 4.4.7 aktualisieren
    • Auf 5.0.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2013-4752

    Mittel · CVSS 6.1EPSS 2,31%Korrektur verfügbar

    CVE-2013-4752

    Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.0.24 aktualisieren
    • Auf 2.1.12 aktualisieren
    • Auf 2.2.5 aktualisieren
    • Auf 2.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2019-18888

    Hoch · CVSS 7.5EPSS 2,25%Korrektur verfügbar

    CVE-2019-18888

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.8.52 aktualisieren
    • Auf 3.4.35 aktualisieren
    • Auf 4.2.12 aktualisieren
    • Auf 4.3.8 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2019-10913

    Kritisch · CVSS 9.8EPSS 1,87%Korrektur verfügbar

    CVE-2019-10913

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.7.51 aktualisieren
    • Auf 2.8.50 aktualisieren
    • Auf 3.4.26 aktualisieren
    • Auf 4.1.12 aktualisieren
    • Auf 4.2.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2018-14773

    Mittel · CVSS 6.5EPSS 57,64%Korrektur verfügbar

    CVE-2018-14773

    An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRI

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.7.49 aktualisieren
    • Auf 2.8.44 aktualisieren
    • Auf 3.3.18 aktualisieren
    • Auf 3.4.14 aktualisieren
    • Auf 4.0.14 aktualisieren
    • Auf 4.1.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2018-11386

    Mittel · CVSS 5.9EPSS 1,58%Korrektur verfügbar

    CVE-2018-11386

    An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Auf 2.7.48 aktualisieren
    • Auf 2.8.41 aktualisieren
    • Auf 3.3.17 aktualisieren
    • Auf 3.4.11 aktualisieren
    • Auf 4.0.11 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2012-6431

    Nicht bewertetEPSS 1,88%Korrektur verfügbar

    CVE-2012-6431

    Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

    symfony/http-foundationPHP
    • Auf 2.0.19 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →