symfony/http-foundation

HIGH 15 Sep 2026

CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

PKSA-xmwy-rmx5-m7h4 · CVE-2026-108082

Affected

≥ 5.4.1, < 5.4.54 ≥ 6.0.1, < 6.4.46 ≥ 7.0.0, < 7.4.19

and 1 more

≥ 8.0.0, < 8.1.7

Fixed in

5.4.54 6.4.46 7.4.19

and 1 more

8.1.7

Published

15 Sep 2026

MODERATE 26 May 2026

CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

PKSA-y6py-qpv1-h52p · CVE-2026-48736

Affected

≥ 6.4.0, < 6.4.41 ≥ 7.0.0, < 7.4.13 ≥ 8.0.0, < 8.0.13

Fixed in

6.4.41 7.4.13 8.0.13

Published

26 May 2026

HIGH7.3 12 Nov 2025

CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass

PKSA-365x-2zjk-pt47 · CVE-2025-64500

Affected

≥ 2.0.0, < 5.4.50 ≥ 6.0.0, < 6.4.29 ≥ 7.0.0, < 7.3.7

Fixed in

5.4.50 6.4.29 7.3.7

Published

12 Nov 2025

LOW3.1 5 Nov 2024

CVE-2024-50345: Open redirect via browser-sanitized URLs

PKSA-b35n-565h-rs4q · CVE-2024-50345

Affected

≥ 2.0.0, < 5.4.46 ≥ 6.0.0, < 6.4.14 ≥ 7.0.0, < 7.1.7

Fixed in

5.4.46 6.4.14 7.1.7

Published

5 Nov 2024

LOW4.3 30 Mar 2020

CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header

PKSA-t4rz-hp2g-57t1 · CVE-2020-5255

Affected

≥ 4.4.0, < 4.4.7 ≥ 5.0.0, < 5.0.7

Fixed in

4.4.7 5.0.7

Published

30 Mar 2020

HIGH7.5 13 Nov 2019

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

PKSA-9w98-4rwq-spxr · CVE-2019-18888

Affected

≥ 2.0.0, < 2.8.52 ≥ 3.0.0, < 3.4.35 ≥ 4.0.0, < 4.2.12

and 1 more

≥ 4.3.0, < 4.3.8

Fixed in

2.8.52 3.4.35 4.2.12

and 1 more

4.3.8

Published

13 Nov 2019

CRITICAL9.8 16 Apr 2019

CVE-2019-10913: Reject invalid HTTP method overrides

PKSA-324d-pqmd-hptz · CVE-2019-10913

Affected

≥ 2.7.0, < 2.7.51 ≥ 2.8.0, < 2.8.50 ≥ 3.0.0, < 3.4.26

and 2 more

≥ 4.0.0, < 4.1.12 ≥ 4.2.0, < 4.2.7

Fixed in

2.7.51 2.8.50 3.4.26

and 2 more

4.1.12 4.2.7

Published

16 Apr 2019

MODERATE6.5 1 Aug 2018

CVE-2018-14773: Remove support for legacy and risky HTTP headers

PKSA-nqj4-v43p-2gxc · CVE-2018-14773

Affected

≥ 2.0.0, < 2.7.49 ≥ 2.8.0, < 2.8.44 ≥ 3.0.0, < 3.3.18

and 3 more

≥ 3.4.0, < 3.4.14 ≥ 4.0.0, < 4.0.14 ≥ 4.1.0, < 4.1.3

Fixed in

2.7.49 2.8.44 3.3.18

and 3 more

3.4.14 4.0.14 4.1.3

Published

1 Aug 2018

MODERATE5.9 25 May 2018

CVE-2018-11386: Denial of service when using PDOSessionHandler

PKSA-f8b8-pbjy-s9k8 · CVE-2018-11386

Affected

≥ 2.0.0, < 2.7.48 ≥ 2.8.0, < 2.8.41 ≥ 3.0.0, < 3.3.17

and 2 more

≥ 3.4.0, < 3.4.11 ≥ 4.0.0, < 4.0.11

Fixed in

2.7.48 2.8.41 3.3.17

and 2 more

3.4.11 4.0.11

Published

25 May 2018

MODERATE 1 Apr 2015

Unsafe methods in the Request class

PKSA-md26-zdw9-222r · CVE-2015-2309

Affected

≥ 2.0.0, < 2.3.27 ≥ 2.4.0, < 2.5.11 ≥ 2.6.0, < 2.6.6

Fixed in

2.3.27 2.5.11 2.6.6

Published

1 Apr 2015

MODERATE 3 Sep 2014

Security issue when parsing the Authorization header

PKSA-dr6c-z2rf-wh36 · CVE-2014-6061

Affected

≥ 2.0.0, < 2.3.19 ≥ 2.4.0, < 2.4.9 ≥ 2.5.0, < 2.5.4

Fixed in

2.3.19 2.4.9 2.5.4

Published

3 Sep 2014

HIGH 3 Sep 2014

Denial of service with a malicious HTTP Host header

PKSA-rhzp-d9k8-shyq · CVE-2014-5244

Affected

≥ 2.0.0, < 2.3.19 ≥ 2.4.0, < 2.4.9 ≥ 2.5.0, < 2.5.4

Fixed in

2.3.19 2.4.9 2.5.4

Published

3 Sep 2014

MODERATE 17 Aug 2013

Request::getHost() poisoning

PKSA-tf6z-kynr-311v · CVE-2013-4752

Affected

≥ 2.0.0, < 2.0.24 ≥ 2.1.0, < 2.1.12 ≥ 2.2.0, < 2.2.5

and 1 more

≥ 2.3.0, < 2.3.3

Fixed in

2.0.24 2.1.12 2.2.5

and 1 more

2.3.3

Published

17 Aug 2013

MODERATE 29 Nov 2012

Request::getClientIp() when the trust proxy mode is enabled

PKSA-hd3k-4852-jhv2

Affected

≥ 2.0.0, < 2.0.19 ≥ 2.1.0, < 2.1.4

Fixed in

2.0.19 2.1.4

Published

29 Nov 2012

MODERATE 19 Mar 2012

Routes behind a firewall are accessible even when not logged in

PKSA-msdq-r83n-tdy4 · CVE-2012-6431

Affected

≥ 2.0.0, < 2.0.19

Fixed in

2.0.19

Published

19 Mar 2012