p PatchFirst

PatchFirst · Latest vulnerabilities

symfony/http-foundation vulnerabilities

Vulnerabilities published for symfony/http-foundation in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 14

  1. CVE-2026-48736

    Medium · CVSS 6.9EPSS 0.57%Fix available

    Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 6.4.41
    • Update to 7.4.13
    • Update to 8.0.13
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2025-64500

    High · CVSS 7.3EPSS 1.41%Public exploitFix available

    Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 5.4.50
    • Update to 6.4.29
    • Update to 7.3.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2024-50345

    Low · CVSS 3.1EPSS 0.59%Fix available

    Open redirect via browser-sanitized URLs in symfony/http-foundation

    symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 5.4.46
    • Update to 6.4.14
    • Update to 7.1.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2015-2309

    Medium · CVSS 5.3Fix available

    Symfony has unsafe methods in the Request class

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintained anymore. ### Description The Symfony\Component\HttpFoundation\Request class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middl

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.3.27
    • Update to 2.5.11
    • Update to 2.6.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2014-6061

    Medium · CVSS 5.3Fix available

    Symfony has a security issue when parsing the Authorization header

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore. ### Description When an application uses an HTTP basic or digest authentication, Symfony does not parse the `Authorization` header properly, which could be exploited in some server setups (no exploits have been demonstrated though.) ### Resolution The parsing of the `Authorization` header has been fixed to comply to the HTTP specification. The patc

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.3.19
    • Update to 2.4.9
    • Update to 2.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2014-5244

    High · CVSS 7.5Fix available

    Symfony vulnerable to denial of service via a malicious HTTP Host header

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore. Description When an arbitrarily long hostname is sent by a client, its parsing in `Request::getHost()` can lead to a DoS attack, due to the way we validate the hostname via a regular expression. Resolution The regular expression used to parse and validate the hostname from the HTTP request has been modified to avoid too much sensitivity to the submi

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.3.19
    • Update to 2.4.9
    • Update to 2.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. GHSA-vfm6-r2gc-pwww

    Not ratedFix available

    Symfony2 security issue when the trust proxy mode is enabled

    An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control. To fix this security issue, the following changes have been made to all versions of Symfony2: A new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP addresses as its argument: ``` // before (probably in your front controller script) Request::trustProxyData(); // after Request::setTrustedProxies(array('1.1.1.1')); // 1.1.1.1 being the IP address of

    symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.0.19
    • Update to 2.1.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2020-5255

    Low · CVSS 2.6EPSS 1.3%Fix available

    Prevent cache poisoning via a Response Content-Type header

    In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

    symfony/http-foundation symfony/http-foundationPHP
    • Update to 4.4.7
    • Update to 5.0.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2013-4752

    Medium · CVSS 6.1EPSS 2.31%Fix available

    CVE-2013-4752

    Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.0.24
    • Update to 2.1.12
    • Update to 2.2.5
    • Update to 2.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2019-18888

    High · CVSS 7.5EPSS 2.25%Fix available

    CVE-2019-18888

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.8.52
    • Update to 3.4.35
    • Update to 4.2.12
    • Update to 4.3.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2019-10913

    Critical · CVSS 9.8EPSS 1.87%Fix available

    CVE-2019-10913

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.7.51
    • Update to 2.8.50
    • Update to 3.4.26
    • Update to 4.1.12
    • Update to 4.2.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2018-14773

    Medium · CVSS 6.5EPSS 57.64%Fix available

    CVE-2018-14773

    An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRI

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.7.49
    • Update to 2.8.44
    • Update to 3.3.18
    • Update to 3.4.14
    • Update to 4.0.14
    • Update to 4.1.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2018-11386

    Medium · CVSS 5.9EPSS 1.58%Fix available

    CVE-2018-11386

    An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Update to 2.7.48
    • Update to 2.8.41
    • Update to 3.3.17
    • Update to 3.4.11
    • Update to 4.0.11
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2012-6431

    Not ratedEPSS 1.88%Fix available

    CVE-2012-6431

    Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

    symfony/http-foundationPHP
    • Update to 2.0.19
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →