Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

symfony/security-http

Symfony Security Component - HTTP Integration

Composer latest 8.1.7 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

8.1.7

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

20 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

20
GHSA-6h46-9jf5-q59x high

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.53ECOSYSTEM: introduced 6.0.0; fixed 6.4.41ECOSYSTEM: introduced 7.0.0; fixed 7.4.13ECOSYSTEM: introduced 8.0.0; fixed 8.0.13>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13

Fixed versions: 5.4.53, 6.4.41, 7.4.13, 8.0.13

CVE-2026-48489 Source ↗Source ↗
GHSA-ph86-p8f6-f9r2 high

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.52ECOSYSTEM: introduced 6.0.0-BETA1; fixed 6.4.40ECOSYSTEM: introduced 7.0.0-BETA1; fixed 7.4.12ECOSYSTEM: introduced 8.0.0-BETA1; fixed 8.0.12>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12

Fixed versions: 5.4.52, 6.4.40, 7.4.12, 8.0.12

CVE-2026-45063 Source ↗Source ↗
GHSA-6439-2f28-8p8q high

Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Affected range

ECOSYSTEM: introduced 7.4.0; fixed 7.4.12ECOSYSTEM: introduced 8.0.0; fixed 8.0.12>=7.4.0,<7.4.12|>=8.0.0,<8.0.12

Fixed versions: 7.4.12, 8.0.12

CVE-2026-45075 Source ↗Source ↗
GHSA-g4m9-5hpf-hx72 high

Firewall configured with unanimous strategy was not actually unanimous in Symfony

Affected range

ECOSYSTEM: introduced 4.4.0; fixed 4.4.7ECOSYSTEM: introduced 5.0.0; fixed 5.0.7>=4.4.0,<4.4.7|>=5.0.0,<5.0.7

Fixed versions: 4.4.7, 5.0.7

CVE-2020-5275 Source ↗Source ↗
GHSA-whgv-8cg3-7hcm high

Symphony Denial of Service Via Overlong Usernames

Affected range

ECOSYSTEM: introduced 2.3.0; fixed 2.3.41ECOSYSTEM: introduced 2.4.0; fixed 2.7.13ECOSYSTEM: introduced 2.8.0; fixed 2.8.6ECOSYSTEM: introduced 3.0.0; fixed 3.0.6>=2.3.0,<2.3.41|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.7.13|>=2.8.0,<2.8.6|>=3.0.0,<3.0.6

Fixed versions: 2.3.41, 2.7.13, 2.8.6, 3.0.6

CVE-2016-4423 Source ↗Source ↗
GHSA-g97c-jfx6-xvxh high

Symfony Vulnerable to Timing Attack

Affected range

ECOSYSTEM: introduced 2.4.0; fixed 2.6.12ECOSYSTEM: introduced 2.7.0; fixed 2.7.7>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.6.12|>=2.7.0,<2.7.7

Fixed versions: 2.6.12, 2.7.7

CVE-2015-8125 Source ↗Source ↗
GHSA-cg23-qf8f-62rr high

Symfony has an Authentication Bypass via RememberMe

Affected range

ECOSYSTEM: introduced 5.3.0; fixed 5.4.47ECOSYSTEM: introduced 6.0.0-BETA1; fixed 6.4.15ECOSYSTEM: introduced 7.0.0-BETA1; fixed 7.1.8>=5.3.0,<5.4.0|>=5.4.0,<5.4.47|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.15|>=7.0.0,<7.1.0|>=7.1.0,<7.1.8

Fixed versions: 5.4.47, 6.4.15, 7.1.8

CVE-2024-51996 Source ↗Source ↗
GHSA-g4g7-q726-v5hg high

Symfony CSRF Token Fixation

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.48ECOSYSTEM: introduced 2.8.0; fixed 2.8.41ECOSYSTEM: introduced 3.0.0; fixed 3.3.17ECOSYSTEM: introduced 3.4.0; fixed 3.4.11ECOSYSTEM: introduced 4.0.0; fixed 4.0.11

Fixed versions: 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11

CVE-2018-11406 Source ↗Source ↗
GHSA-g4rg-rw65-8hfg high

Symfony Session Fixation Vulnerability

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.48ECOSYSTEM: introduced 2.8.0; fixed 2.8.41ECOSYSTEM: introduced 3.0.0; fixed 3.3.17ECOSYSTEM: introduced 3.4.0; fixed 3.4.11ECOSYSTEM: introduced 4.0.0; fixed 4.0.11

Fixed versions: 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11

CVE-2018-11385 Source ↗Source ↗
GHSA-cchx-mfrc-fwqr high

Improper authentication in Symfony

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.51ECOSYSTEM: introduced 2.8.0; fixed 2.8.50ECOSYSTEM: introduced 3.0.0; fixed 3.4.26ECOSYSTEM: introduced 4.0.0; fixed 4.1.12ECOSYSTEM: introduced 4.2.0; fixed 4.2.7

Fixed versions: 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7

CVE-2019-10911 Source ↗Source ↗
GHSA-j8gj-9rm5-4xhx moderate

Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

Affected range

ECOSYSTEM: introduced 7.1.0; fixed 7.4.12ECOSYSTEM: introduced 8.0.0; fixed 8.0.12>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12

Fixed versions: 7.4.12, 8.0.12

CVE-2026-45074 Source ↗Source ↗
GHSA-29fc-p6c4-24cg moderate

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Affected range

ECOSYSTEM: introduced 6.3.0; fixed 6.4.40ECOSYSTEM: introduced 7.4.0; fixed 7.4.12ECOSYSTEM: introduced 8.0.0; fixed 8.0.12>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12

Fixed versions: 6.4.40, 7.4.12, 8.0.12

CVE-2026-45069 Source ↗Source ↗
GHSA-m2wj-r6g3-fxfx moderate

Symfony possible session fixation vulnerability

Affected range

ECOSYSTEM: introduced 5.4.21; fixed 5.4.31ECOSYSTEM: introduced 6.2.7; fixed 6.3.8>=5.4.0,<5.4.31|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.3.8

Fixed versions: 5.4.31, 6.3.8

CVE-2023-46733 Source ↗Source ↗
GHSA-89r2-5g34-2g47 moderate

Symfony Open Redirect

Affected range

ECOSYSTEM: introduced 2.7.38; fixed 2.7.50ECOSYSTEM: introduced 2.8.0; fixed 2.8.49ECOSYSTEM: introduced 3.0.0; fixed 3.4.20ECOSYSTEM: introduced 4.0.0; fixed 4.0.15ECOSYSTEM: introduced 4.1.0; fixed 4.1.9

Fixed versions: 2.7.50, 2.8.49, 3.4.20, 4.0.15, 4.1.9, 4.2.1

CVE-2018-19790 Source ↗Source ↗
GHSA-r7p7-qr7p-2rrf moderate

Symfony Open Redirect

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.38ECOSYSTEM: introduced 2.8.0; fixed 2.8.31ECOSYSTEM: introduced 3.2.0; fixed 3.2.14ECOSYSTEM: introduced 3.3.0; fixed 3.3.13>=2.7.0,<2.7.38|>=2.8.0,<2.8.31|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.2.14|>=3.3.0,<3.3.13

Fixed versions: 2.7.38, 2.8.31, 3.2.14, 3.3.13

CVE-2017-16652 Source ↗Source ↗
GHSA-4vpc-5jx4-cfqg moderate

User enumeration leak using switch user functionality in Symfony

Affected range

ECOSYSTEM: introduced 4.1.0; fixed 4.2.12ECOSYSTEM: introduced 4.3.0; fixed 4.3.8>=4.1.0,<4.2.0|>=4.2.0,<4.2.12|>=4.3.0,<4.3.8

Fixed versions: 4.2.12, 4.3.8

CVE-2019-18886 Source ↗Source ↗
GHSA-g2qj-pmxm-9f8f low

User enumeration in authentication mechanisms

Affected range

ECOSYSTEM: introduced 5.1.0; fixed 5.2.8>=5.1.0,<5.2.8

Fixed versions: 5.2.8

Source ↗Source ↗
GHSA-j5jh-hpr4-h332 low

Symfony Session Fixation Vulnerability

Affected range

ECOSYSTEM: introduced 2.4.0; fixed 2.6.12ECOSYSTEM: introduced 2.7.0; fixed 2.7.7>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.6.12|>=2.7.0,<2.7.7

Fixed versions: 2.6.12, 2.7.7

CVE-2015-8124 Source ↗Source ↗