Symfony vulnerable to open redirect via browser-sanitized URLs
Published 6 Nov 2024 · Updated 3 Nov 2025
Affected packages
- Affected
- <5.4.46
- Fixed in
- 5.4.46
composer require symfony/http-foundation:^5.4.46- Affected
- >=6.0.0 <6.4.14
- Fixed in
- 6.4.14
composer require symfony/http-foundation:^6.4.14- Affected
- >=7.0.0 <7.1.7
- Fixed in
- 7.1.7
composer require symfony/http-foundation:^7.1.7Details
Description
The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.
Resolution
The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
Is GHSA-mrqx-rp3w-jpjp in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/http-foundation, and gives you the command that fixes it.
References
- Linkgithub.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-50345
- Linkgithub.com/symfony/symfony/commit/5a9b08e5740af795854b1b639b7d45b9cbfe8819
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2024-50345.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50345.yaml
- Packagegithub.com/symfony/symfony
- Linklists.debian.org/debian-lts-announce/2025/05/msg00051.html
- Linksymfony.com/cve-2024-50345
- Linkurl.spec.whatwg.org
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.