Skip to content
OpenAdvisories

Package · Packagist

symfony/http-kernel

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.3
    CVE-2026-45075

    Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony route…

    symfony symfony security-http http-kernel Debian Ubuntu Packagist
  • High 7.5
    CVE-2014-5245

    Symfony allows direct access of ESI URLs behind a trusted proxy

    All 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpKernel component are affected by this security issue. Your application is vulnerable only if the ESI feature is enabled and there is a proxy in front of the web application. This issue has been fi…

    symfony/symfony symfony/http-kernel Packagist
  • High 8.0
    CVE-2020-15094

    RCE in Symfony

    In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cac…

    symfony symfony symfony/symfony symfony Debian Packagist
  • High 8.1
    CVE-2019-18887

    Symfony Http-Kernel has non-constant time comparison in UriSigner

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.

    symfony/symfony symfony symfony symfony/http-kernel Debian Ubuntu Packagist