Skip to content
OpenAdvisories

Package · Packagist

symfony/http-foundation

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-108082

    Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, fo…

    sensiolabs symfony symfony/symfony symfony Debian Ubuntu Packagist
  • High 7.3
    CVE-2025-64500 Scanner template

    Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, an…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist
  • High 7.5
    CVE-2014-5244

    Symfony vulnerable to denial of service via a malicious HTTP Host header

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2…

    symfony/symfony symfony/http-foundation Packagist
  • High 7.5
    CVE-2019-18888

    Argument injection in a MimeTypeGuesser in Symfony

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are…

    symfony/symfony symfony symfony symfony/http-foundation Debian Ubuntu Packagist