Is symfony/http-kernel 4.3 vulnerable?

Composer · 12 releases from 4.3.0 to 4.3.11 · latest symfony/http-kernel is 8.1.10 · checked 2 Nov 2026

Yes: 2 known advisories

Yes. symfony/http-kernel 4.3.11, the last 4.3 release, is affected by 2 known security advisories (1 high, 1 medium), including CVE-2020-15094, CVE-2022-24894. 1 more affects earlier 4.3.x releases. Upgrade to 4.4.50 or later to fix all of them.

Upgrade with:composer require symfony/http-kernel:^4.4.50

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting symfony/http-kernel 4.3.11

  • MediumCVE-2022-24894GHSA-h7vf-5wrv-9fhv1 Feb 2023

    Symfony storing cookie headers in HttpCache

    Affected
    >=2.0.0 <4.4.50 · >=5.0.0 <5.4.20 · >=6.0.0 <6.0.20 · >=6.1.0 <6.1.12 · >=6.2.0 <6.2.6
    Fixed in
    4.4.50, 5.4.20, 6.0.20, 6.1.12, 6.2.6
  • HighCVE-2020-15094GHSA-754h-5r27-7x3r2 Sept 2020

    RCE in Symfony

    Affected
    >=4.3.0 <4.4.13 · >=5.0.0 <5.1.5
    Fixed in
    4.4.13, 5.1.5

Fixed within 4.3.x, affecting earlier releases

  • HighCVE-2019-18887GHSA-q8hg-pf8v-cxrv26 Mar 2022

    Symfony Http-Kernel has non-constant time comparison in UriSigner

    Affected
    >=2.2.0 <2.8.52 · >=3.0.0 <3.4.35 · >=4.0.0 <4.2.12 · >=4.3.0 <4.3.8
    Fixed in
    2.8.52, 3.4.35, 4.2.12, 4.3.8

Which of your client projects are still on symfony/http-kernel 4.3?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact symfony/http-kernel version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other symfony/http-kernel versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.