composer

symfony/routing

Security advisories for symfony/routing, newest first. 4 known, all fixed. If you’re on 8.0.13 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.1.10

Advisories

4 · 0 unfixed

Last advisory

26 May 2026

Safe from

8.0.13

4 advisories · newest first

MODERATE 26 May 2026

CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

PKSA-bf7t-jnpz-492k · CVE-2026-48784

Affected

≥ 2.0.0, < 5.4.53 ≥ 6.0.0, < 6.4.41 ≥ 7.0.0, < 7.4.13

and 1 more

≥ 8.0.0, < 8.0.13

Fixed in

5.4.53 6.4.41 7.4.13

and 1 more

8.0.13

Published

26 May 2026

MODERATE 20 May 2026

CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

PKSA-yc7t-91v9-99xs · CVE-2026-45065

Affected

≥ 2.0.0, < 5.4.52 ≥ 6.0.0, < 6.4.40 ≥ 7.0.0, < 7.4.12

and 1 more

≥ 8.0.0, < 8.0.12

Fixed in

5.4.52 6.4.40 7.4.12

and 1 more

8.0.12

Published

20 May 2026

HIGH 28 Aug 2012

Security fixes related to the way XML is handled

PKSA-g1jq-pppn-wyhk

Affected

≥ 2.0.0, < 2.0.17

Fixed in

2.0.17

Published

28 Aug 2012

MODERATE 19 Mar 2012

Routes behind a firewall are accessible even when not logged in

PKSA-p71j-52x5-sfs1 · CVE-2012-6431

Affected

≥ 2.0.0, < 2.0.19

Fixed in

2.0.19

Published

19 Mar 2012

/advisories/composer/symfony/routing/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

symfony/cache3 advisories symfony/dom-crawler1 advisory symfony/error-handler1 advisory symfony/expression-language1 advisory symfony/http-client2 advisories symfony/http-foundation15 advisories symfony/http-kernel8 advisories symfony/mailer1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →