symfony/http-foundation vulnerabilities
Defines an object-oriented layer for the HTTP specification
- Registry
- Composer
- Latest
- 8.1.9
- License
- MIT
14 known advisories
The latest version, 8.1.9, is not affected by any of them. Projects on older versions may be.
composer require symfony/http-foundation:^8.1.9Security advisories for symfony/http-foundation
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
- Affected
- >=6.4.0 <6.4.41 · >=7.0.0 <7.4.13 · >=8.0.0 <8.0.13
- Fixed in
- 6.4.41, 7.4.13, 8.0.13
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
- Affected
- <5.4.50 · >=6.0.0 <6.4.29 · >=7.0.0 <7.3.7
- Fixed in
- 5.4.50, 6.4.29, 7.3.7
Symfony vulnerable to open redirect via browser-sanitized URLs
- Affected
- <5.4.46 · >=6.0.0 <6.4.14 · >=7.0.0 <7.1.7
- Fixed in
- 5.4.46, 6.4.14, 7.1.7
Symfony has unsafe methods in the Request class
- Affected
- >=2.0.0 <2.3.27 · >=2.4.0 <2.5.11 · >=2.6.0 <2.6.6
- Fixed in
- 2.3.27, 2.5.11, 2.6.6
Symfony has a security issue when parsing the Authorization header
- Affected
- >=2.0.0 <2.3.19 · >=2.4.0 <2.4.9 · >=2.5.0 <2.5.4
- Fixed in
- 2.3.19, 2.4.9, 2.5.4
Symfony vulnerable to denial of service via a malicious HTTP Host header
- Affected
- >=2.0.0 <2.3.19 · >=2.4.0 <2.4.9 · >=2.5.0 <2.5.4
- Fixed in
- 2.3.19, 2.4.9, 2.5.4
Symfony2 security issue when the trust proxy mode is enabled
- Affected
- >=2.0.0 <2.0.19 · >=2.1.0 <2.1.4
- Fixed in
- 2.0.19, 2.1.4
Symfony Allows URI Restrictions Bypass Via Double-Encoded String
- Affected
- >=2.0.0 <2.0.19
- Fixed in
- 2.0.19
Symfony DoS
- Affected
- >=2.7.0 <2.7.48 · >=2.8.0 <2.8.41 · >=3.3.0 <3.3.17 · >=3.4.0 <3.4.11 · >=4.0.0 <4.0.11
- Fixed in
- 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
Symfony HTTP Foundation web cache poisoning
- Affected
- >=2.7.0 <2.7.49 · >=2.8.0 <2.8.44 · >=3.0.0 <3.3.18 · >=3.4.0 <3.4.14 · >=4.0.0 <4.0.14 · >=4.1.0 <4.1.3
- Fixed in
- 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.3
Symfony Host Header Injection vulnerability in the HttpFoundation component
- Affected
- >=2.0.0 <2.0.24 · >=2.1.0 <2.1.12 · >=2.2.0 <2.2.5 · >=2.3.0 <2.3.3
- Fixed in
- 2.0.24, 2.1.12, 2.2.5, 2.3.3
Prevent cache poisoning via a Response Content-Type header in Symfony
- Affected
- >=4.4.0 <4.4.7 · >=5.0.0 <5.0.7
- Fixed in
- 4.4.7, 5.0.7
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
- Affected
- >=2.7.0 <2.7.51 · >=2.8.0 <2.8.50 · >=3.0.0 <3.4.26 · >=4.0.0 <4.1.12 · >=4.2.0 <4.2.7
- Fixed in
- 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7
Argument injection in a MimeTypeGuesser in Symfony
- Affected
- >=2.0.0 <2.8.52 · >=3.0.0 <3.4.35 · >=4.0.0 <4.2.12 · >=4.3.0 <4.3.8
- Fixed in
- 2.8.52, 3.4.35, 4.2.12, 4.3.8
Which of your client projects still run an old symfony/http-foundation?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.