composer

symfony/http-kernel

Security advisories for symfony/http-kernel, newest first. 8 known, all fixed. If you’re on 8.0.12 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.1.10

Advisories

8 · 0 unfixed

Last advisory

20 May 2026

Safe from

8.0.12

8 advisories · newest first

HIGH 20 May 2026

CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

PKSA-dw7n-x7f5-zf63 · CVE-2026-45075

Affected

≥ 7.4.0, < 7.4.12 ≥ 8.0.0, < 8.0.12

Fixed in

7.4.12 8.0.12

Published

20 May 2026

MODERATE5.9 1 Feb 2023

CVE-2022-24894: Prevent storing cookie headers in HttpCache

PKSA-hr4y-jwk2-1yb9 · CVE-2022-24894

Affected

≥ 2.0.0, < 4.4.50 ≥ 5.0.0, < 5.4.20 ≥ 6.0.0, < 6.0.20

and 2 more

≥ 6.1.0, < 6.1.12 ≥ 6.2.0, < 6.2.6

Fixed in

4.4.50 5.4.20 6.0.20

and 2 more

6.1.12 6.2.6

Published

1 Feb 2023

MODERATE6.5 9 Oct 2021

CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request

PKSA-ftqt-8gzv-r53t · CVE-2021-41267

Affected

≥ 5.2.0, < 5.3.12

Fixed in

5.3.12

Published

9 Oct 2021

HIGH8.8 2 Sep 2020

CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient

PKSA-8knv-7jsn-12w8 · CVE-2020-15094

Affected

≥ 4.3.0, < 4.4.13 ≥ 5.0.0, < 5.1.5

Fixed in

4.4.13 5.1.5

Published

2 Sep 2020

HIGH8.1 13 Nov 2019

CVE-2019-18887: Use constant time comparison in UriSigner

PKSA-sn9k-4yr8-6s9c · CVE-2019-18887

Affected

≥ 2.2.0, < 2.8.52 ≥ 3.0.0, < 3.4.35 ≥ 4.0.0, < 4.2.12

and 1 more

≥ 4.3.0, < 4.3.8

Fixed in

2.8.52 3.4.35 4.2.12

and 1 more

4.3.8

Published

13 Nov 2019

MODERATE 26 May 2015

CVE-2015-4050: ESI unauthorized access

PKSA-35ts-w5by-rx5d · CVE-2015-4050

Affected

≥ 2.3.19, < 2.3.29 ≥ 2.4.9, < 2.5.0 ≥ 2.5.4, < 2.5.12

and 1 more

≥ 2.6.0, < 2.6.8

Fixed in

2.3.29 2.5.0 2.5.12

and 1 more

2.6.8

Published

26 May 2015

MODERATE 1 Apr 2015

Esi Code Injection

PKSA-15jn-wzq4-94pw · CVE-2015-2308

Affected

≥ 2.0.0, < 2.3.27 ≥ 2.4.0, < 2.5.11 ≥ 2.6.0, < 2.6.6

Fixed in

2.3.27 2.5.11 2.6.6

Published

1 Apr 2015

HIGH 3 Sep 2014

Direct access of ESI URLs behind a trusted proxy

PKSA-6dsk-crym-v443 · CVE-2014-5245

Affected

≥ 2.0.0, < 2.3.19 ≥ 2.4.0, < 2.4.9 ≥ 2.5.0, < 2.5.4

Fixed in

2.3.19 2.4.9 2.5.4

Published

3 Sep 2014

/advisories/composer/symfony/http-kernel/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

symfony/cache3 advisories symfony/dom-crawler1 advisory symfony/error-handler1 advisory symfony/expression-language1 advisory symfony/http-client2 advisories symfony/http-foundation15 advisories symfony/mailer1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →