Skip to content
OpenAdvisories

Package · Packagist

symfony/http-kernel

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • High 8.3
    CVE-2026-45075

    Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony route…

    symfony symfony security-http http-kernel Debian Ubuntu Packagist
  • High 7.5
    CVE-2014-5245

    Symfony allows direct access of ESI URLs behind a trusted proxy

    All 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpKernel component are affected by this security issue. Your application is vulnerable only if the ESI feature is enabled and there is a proxy in front of the web application. This issue has been fi…

    symfony/symfony symfony/http-kernel Packagist
  • Medium 5.9
    CVE-2022-24894 Public exploit

    Symfony storing cookie headers in HttpCache

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist
  • Medium 6.5
    CVE-2021-41267

    Webcache Poisoning in Symfony

    Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache pois…

    symfony symfony symfony/symfony symfony/http-kernel Packagist
  • High 8.0
    CVE-2020-15094

    RCE in Symfony

    In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cac…

    symfony symfony symfony/symfony symfony Debian Packagist
  • High 8.1
    CVE-2019-18887

    Symfony Http-Kernel has non-constant time comparison in UriSigner

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.

    symfony/symfony symfony symfony symfony/http-kernel Debian Ubuntu Packagist
  • Medium —
    CVE-2015-2308

    Symfony Vulnerable to PHP Eval Injection

    Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.

    symfony/symfony symfony symfony/http-kernel Debian Packagist
  • Medium —
    CVE-2015-4050

    Symfony Incorrect Access Control

    FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attack…

    symfony/symfony symfony symfony/http-kernel Debian Packagist