Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

symfony/http-foundation

Defines an object-oriented layer for the HTTP specification

Composer latest 8.1.7 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

8.1.7

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

14 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

14
GHSA-x92h-wmg2-6hp7 critical

Invalid HTTP method overrides allow possible XSS or other attacks in Symfony

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.51ECOSYSTEM: introduced 2.8.0; fixed 2.8.50ECOSYSTEM: introduced 3.0.0; fixed 3.4.26ECOSYSTEM: introduced 4.0.0; fixed 4.1.12ECOSYSTEM: introduced 4.2.0; fixed 4.2.7

Fixed versions: 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7

CVE-2019-10913 Source ↗Source ↗
GHSA-3rg7-wf37-54rm high

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.50ECOSYSTEM: introduced 6.0.0; fixed 6.4.29ECOSYSTEM: introduced 7.0.0; fixed 7.3.7>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.50|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.29|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.3.7

Fixed versions: 5.4.50, 6.4.29, 7.3.7

CVE-2025-64500 Source ↗Source ↗
GHSA-v77v-x634-9m56 high

Symfony vulnerable to denial of service via a malicious HTTP Host header

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.3.19ECOSYSTEM: introduced 2.4.0; fixed 2.4.9ECOSYSTEM: introduced 2.5.0; fixed 2.5.4>=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.3.19|>=2.4.0,<2.4.9|>=2.5.0,<2.5.4

Fixed versions: 2.3.19, 2.4.9, 2.5.4

CVE-2014-5244 Source ↗Source ↗
GHSA-xhh6-956q-4q69 high

Argument injection in a MimeTypeGuesser in Symfony

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.8.52ECOSYSTEM: introduced 3.0.0; fixed 3.4.35ECOSYSTEM: introduced 4.0.0; fixed 4.2.12ECOSYSTEM: introduced 4.3.0; fixed 4.3.8>=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.8.0|>=2.8.0,<2.8.52|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<3.4.35|>=4.0.0,<4.1.0|>=4.1.0,<4.2.0|>=4.2.0,<4.2.12|>=4.3.0,<4.3.8

Fixed versions: 2.8.52, 3.4.35, 4.2.12, 4.3.8

CVE-2019-18888 Source ↗Source ↗
GHSA-38cx-cq6f-5755 moderate

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Affected range

ECOSYSTEM: introduced 6.4.0; fixed 6.4.41ECOSYSTEM: introduced 7.0.0; fixed 7.4.13ECOSYSTEM: introduced 8.0.0; fixed 8.0.13>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13

Fixed versions: 6.4.41, 7.4.13, 8.0.13

CVE-2026-48736 Source ↗Source ↗
GHSA-vfm6-r2gc-pwww moderate

Symfony2 security issue when the trust proxy mode is enabled

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.0.19ECOSYSTEM: introduced 2.1.0; fixed 2.1.4>=2.0.0,<2.0.19|>=2.1.0,<2.1.4

Fixed versions: 2.0.19, 2.1.4

Source ↗Source ↗
GHSA-p684-f7fh-jv2j moderate

Symfony has unsafe methods in the Request class

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.3.27ECOSYSTEM: introduced 2.4.0; fixed 2.5.11ECOSYSTEM: introduced 2.6.0; fixed 2.6.6>=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.3.27|>=2.4.0,<2.5.0|>=2.5.0,<2.5.11|>=2.6.0,<2.6.6

Fixed versions: 2.3.27, 2.5.11, 2.6.6

CVE-2015-2309 Source ↗Source ↗
GHSA-h7v2-2qwg-h829 moderate

Symfony has a security issue when parsing the Authorization header

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.3.19ECOSYSTEM: introduced 2.4.0; fixed 2.4.9ECOSYSTEM: introduced 2.5.0; fixed 2.5.4>=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.3.19|>=2.4.0,<2.4.9|>=2.5.0,<2.5.4

Fixed versions: 2.3.19, 2.4.9, 2.5.4

CVE-2014-6061 Source ↗Source ↗
GHSA-22pv-7v9j-hqxp moderate

Symfony Host Header Injection vulnerability in the HttpFoundation component

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.0.24ECOSYSTEM: introduced 2.1.0; fixed 2.1.12ECOSYSTEM: introduced 2.2.0; fixed 2.2.5ECOSYSTEM: introduced 2.3.0; fixed 2.3.3>=2.0.0,<2.0.24|>=2.1.0,<2.1.12|>=2.2.0,<2.2.5|>=2.3.0,<2.3.3

Fixed versions: 2.0.24, 2.1.12, 2.2.5, 2.3.3

CVE-2013-4752 Source ↗Source ↗
GHSA-r2rq-3h56-fqm4 moderate

Symfony DoS

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.48ECOSYSTEM: introduced 2.8.0; fixed 2.8.41ECOSYSTEM: introduced 3.3.0; fixed 3.3.17ECOSYSTEM: introduced 3.4.0; fixed 3.4.11ECOSYSTEM: introduced 4.0.0; fixed 4.0.11

Fixed versions: 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11

CVE-2018-11386 Source ↗Source ↗
GHSA-8wgj-6wx8-h5hq moderate

Symfony HTTP Foundation web cache poisoning

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.49ECOSYSTEM: introduced 2.8.0; fixed 2.8.44ECOSYSTEM: introduced 3.0.0; fixed 3.3.18ECOSYSTEM: introduced 3.4.0; fixed 3.4.14ECOSYSTEM: introduced 4.0.0; fixed 4.0.14

Fixed versions: 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.3

CVE-2018-14773 Source ↗Source ↗
GHSA-mcx4-f5f5-4859 low

Prevent cache poisoning via a Response Content-Type header in Symfony

Affected range

ECOSYSTEM: introduced 4.4.0; fixed 4.4.7ECOSYSTEM: introduced 5.0.0; fixed 5.0.7>=4.4.0,<4.4.7|>=5.0.0,<5.0.7

Fixed versions: 4.4.7, 5.0.7

CVE-2020-5255 Source ↗Source ↗
GHSA-mrqx-rp3w-jpjp low

Symfony vulnerable to open redirect via browser-sanitized URLs

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.46ECOSYSTEM: introduced 6.0.0; fixed 6.4.14ECOSYSTEM: introduced 7.0.0; fixed 7.1.7>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7

Fixed versions: 5.4.46, 6.4.14, 7.1.7

CVE-2024-50345 Source ↗Source ↗