Approved changes feed: RSS · Atom

cpe:2.3:a:symfony:security-http:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorSymfony (88011d02-04e0-53e8-bc79-472f99951c29)
ProductSecurity Http (3983c641-21d0-5ca7-ae63-dd56cc6ba051)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-48489 vulnerable 2026-07-29 00:55:01.358428 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Published: 2026-07-14T19:14:12.233Z
Updated: 2026-07-16T14:40:10.013Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-45075 vulnerable 2026-07-29 00:52:15.064175 Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.
Published: 2026-07-14T18:40:37.287Z
Updated: 2026-07-16T14:38:19.284Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-45074 vulnerable 2026-07-29 00:52:15.061530 Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.
Published: 2026-07-14T17:49:24.895Z
Updated: 2026-07-14T18:24:34.062Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.