p PatchFirst

CVE-2026-45075

CVE-2026-45075 · Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.

CVSS 8.3 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • symfony

    Versions
    • >= 7.4.0-BETA1, < 7.4.12: Affected
    • >= 8.0.0-BETA1, < 8.0.12: Affected

    No fix published

  • http-kernel

    Versions
    • >= 7.4.0-BETA1, < 7.4.12: Affected
    • >= 8.0.0-BETA1, < 8.0.12: Affected

    No fix published

  • security-http

    Versions
    • >= 7.4.0-BETA1, < 7.4.12: Affected
    • >= 8.0.0-BETA1, < 8.0.12: Affected

    No fix published

  • symfony Debian:14

    Versions
    • 6.4.21+dfsg-2
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 7.4.12+dfsg-1

    Update to 7.4.12+dfsg-1

  • symfony/http-kernel Packagist

    Versions
    • v7.4.0
    • v7.4.1
    • v7.4.10
    • v7.4.11
    • v7.4.2
    • v7.4.3
    • v7.4.4
    • v7.4.5
    • v7.4.6
    • v7.4.7
    • v7.4.8
    Affected ranges
    • ECOSYSTEM: ≥ 7.4.0, < 7.4.12

    Update to 7.4.12

  • symfony/http-kernel Packagist

    Versions
    • v8.0.0
    • v8.0.1
    • v8.0.10
    • v8.0.11
    • v8.0.2
    • v8.0.3
    • v8.0.4
    • v8.0.5
    • v8.0.6
    • v8.0.7
    • v8.0.8
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.0.12

    Update to 8.0.12

  • symfony/security-http Packagist

    Versions
    • v7.4.0
    • v7.4.1
    • v7.4.11
    • v7.4.3
    • v7.4.4
    • v7.4.6
    • v7.4.8
    • v7.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 7.4.0, < 7.4.12

    Update to 7.4.12

  • symfony/security-http Packagist

    Versions
    • v8.0.0
    • v8.0.1
    • v8.0.11
    • v8.0.3
    • v8.0.4
    • v8.0.6
    • v8.0.8
    • v8.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.0.12

    Update to 8.0.12

  • symfony/symfony Packagist

    Versions
    • v7.4.0
    • v7.4.1
    • v7.4.10
    • v7.4.11
    • v7.4.2
    • v7.4.3
    • v7.4.4
    • v7.4.5
    • v7.4.6
    • v7.4.7
    • v7.4.8
    • v7.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 7.4.0, < 7.4.12

    Update to 7.4.12

  • symfony/symfony Packagist

    Versions
    • v8.0.0
    • v8.0.1
    • v8.0.10
    • v8.0.11
    • v8.0.2
    • v8.0.3
    • v8.0.4
    • v8.0.5
    • v8.0.6
    • v8.0.7
    • v8.0.8
    • v8.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.0.12

    Update to 8.0.12

  • symfony Ubuntu:16.04:LTS

    Versions
    • 2.7.1+dfsg-1
    • 2.7.5+dfsg-1
    • 2.7.9+dfsg-1
    • 2.7.9+dfsg-1ubuntu2
    • 2.7.10-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:18.04:LTS

    Versions
    • 2.8.7+dfsg-1.3ubuntu1
    • 3.4.3+dfsg-1ubuntu4
    • 3.4.6+dfsg-1
    • 3.4.6+dfsg-1ubuntu0.1
    • 3.4.6+dfsg-1ubuntu0.1+esm1
    • 3.4.6+dfsg-1ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:20.04:LTS

    Versions
    • 4.3.4+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1+esm1
    • 4.3.8+dfsg-1ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:22.04:LTS

    Versions
    • 5.2.6+dfsg-1ubuntu7
    • 5.4.4+dfsg-1ubuntu8
    • 5.4.4+dfsg-1ubuntu8+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:24.04:LTS

    Versions
    • 5.4.23+dfsg-1ubuntu1
    • 5.4.35+dfsg-3ubuntu1
    • 6.4.5+dfsg-3ubuntu2
    • 6.4.5+dfsg-3ubuntu3
    • 6.4.5+dfsg-3ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:25.10

    Versions
    • 6.4.18+dfsg-1ubuntu1
    • 6.4.21+dfsg-2
    • 6.4.21+dfsg-2ubuntu1
    • 6.4.24+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.10

    Versions
    • 7.4.7+dfsg-1ubuntu1
    • 7.4.9+dfsg-1ubuntu1
    • 7.4.13+dfsg-2ubuntu1
    • 7.4.14+dfsg-1ubuntu2
    • 7.4.15+dfsg-2ubuntu2
    • 7.4.16+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.04:LTS

    Versions
    • 6.4.24+dfsg-1
    • 7.4.5+dfsg-1ubuntu1
    • 7.4.6+dfsg-2ubuntu1
    • 7.4.7+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →