symfony/http-foundation (Packagist)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 8.1.7 or later clears every advisory below that has a fix.

Upgrade commands

composer

composer require symfony/http-foundation:^8.1.7

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header	High EPSS 0.48%	`>= 6.0.1, < 6.4.46`	`6.4.46`
GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header	High EPSS 0.48%	`>= 4.1.0, < 5.4.54`	`5.4.54`
GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header	High EPSS 0.48%	`>= 8.0.0, < 8.1.7`	`8.1.7`
GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header	High EPSS 0.48%	`>= 7.0.0, < 7.4.19`	`7.4.19`
GHSA-38cx-cq6f-5755 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient	High EPSS 0.57%	`>= 8.0.0, < 8.0.13`	`8.0.13`
GHSA-38cx-cq6f-5755 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient	High EPSS 0.57%	`>= 6.4.0, < 6.4.41`	`6.4.41`
GHSA-38cx-cq6f-5755 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient	High EPSS 0.57%	`>= 7.0.0, < 7.4.13`	`7.4.13`
GHSA-3rg7-wf37-54rm Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass	High EPSS 1.41%	`>= 7.0.0, < 7.3.7`	`7.3.7`
GHSA-3rg7-wf37-54rm Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass	High EPSS 1.41%	`< 5.4.50`	`5.4.50`
GHSA-3rg7-wf37-54rm Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass	High EPSS 1.41%	`>= 6.0.0, < 6.4.29`	`6.4.29`
GHSA-p684-f7fh-jv2j Symfony has unsafe methods in the Request class	Medium	`>= 2.4.0, < 2.5.11`	`2.5.11`
GHSA-p684-f7fh-jv2j Symfony has unsafe methods in the Request class	Medium	`>= 2.6.0, < 2.6.6`	`2.6.6`
GHSA-p684-f7fh-jv2j Symfony has unsafe methods in the Request class	Medium	`>= 2.0.0, < 2.3.27`	`2.3.27`
GHSA-h7v2-2qwg-h829 Symfony has a security issue when parsing the Authorization header	Medium	`>= 2.0.0, < 2.3.19`	`2.3.19`
GHSA-h7v2-2qwg-h829 Symfony has a security issue when parsing the Authorization header	Medium	`>= 2.5.0, < 2.5.4`	`2.5.4`
GHSA-h7v2-2qwg-h829 Symfony has a security issue when parsing the Authorization header	Medium	`>= 2.4.0, < 2.4.9`	`2.4.9`
GHSA-v77v-x634-9m56 Symfony vulnerable to denial of service via a malicious HTTP Host header	High	`>= 2.4.0, < 2.4.9`	`2.4.9`
GHSA-v77v-x634-9m56 Symfony vulnerable to denial of service via a malicious HTTP Host header	High	`>= 2.0.0, < 2.3.19`	`2.3.19`
GHSA-v77v-x634-9m56 Symfony vulnerable to denial of service via a malicious HTTP Host header	High	`>= 2.5.0, < 2.5.4`	`2.5.4`
GHSA-vfm6-r2gc-pwww Symfony2 security issue when the trust proxy mode is enabled	Medium	`>= 2.1.0, < 2.1.4`	`2.1.4`
GHSA-vfm6-r2gc-pwww Symfony2 security issue when the trust proxy mode is enabled	Medium	`>= 2.0.0, < 2.0.19`	`2.0.19`
GHSA-83c3-qx27-2rwr Symfony Allows URI Restrictions Bypass Via Double-Encoded String	Medium EPSS 1.88%	`>= 2.0.0, < 2.0.19`	`2.0.19`
GHSA-r2rq-3h56-fqm4 Symfony DoS	Medium EPSS 1.58%	`>= 3.4.0, < 3.4.11`	`3.4.11`
GHSA-r2rq-3h56-fqm4 Symfony DoS	Medium EPSS 1.58%	`>= 2.8.0, < 2.8.41`	`2.8.41`
GHSA-r2rq-3h56-fqm4 Symfony DoS	Medium EPSS 1.58%	`>= 3.3.0, < 3.3.17`	`3.3.17`
GHSA-r2rq-3h56-fqm4 Symfony DoS	Medium EPSS 1.58%	`>= 2.7.0, < 2.7.48`	`2.7.48`
GHSA-r2rq-3h56-fqm4 Symfony DoS	Medium EPSS 1.58%	`>= 4.0.0, < 4.0.11`	`4.0.11`
GHSA-8wgj-6wx8-h5hq Symfony HTTP Foundation web cache poisoning	Medium EPSS 57.64%	`>= 3.4.0, < 3.4.14`	`3.4.14`
GHSA-8wgj-6wx8-h5hq Symfony HTTP Foundation web cache poisoning	Medium EPSS 57.64%	`>= 2.7.0, < 2.7.49`	`2.7.49`
GHSA-8wgj-6wx8-h5hq Symfony HTTP Foundation web cache poisoning	Medium EPSS 57.64%	`>= 2.8.0, < 2.8.44`	`2.8.44`
GHSA-8wgj-6wx8-h5hq Symfony HTTP Foundation web cache poisoning	Medium EPSS 57.64%	`>= 3.0.0, < 3.3.18`	`3.3.18`
GHSA-8wgj-6wx8-h5hq Symfony HTTP Foundation web cache poisoning	Medium EPSS 57.64%	`>= 4.0.0, < 4.0.14`	`4.0.14`
GHSA-8wgj-6wx8-h5hq Symfony HTTP Foundation web cache poisoning	Medium EPSS 57.64%	`>= 4.1.0, < 4.1.3`	`4.1.3`
GHSA-22pv-7v9j-hqxp Symfony Host Header Injection vulnerability in the HttpFoundation component	Medium EPSS 2.31%	`>= 2.3.0, < 2.3.3`	`2.3.3`
GHSA-22pv-7v9j-hqxp Symfony Host Header Injection vulnerability in the HttpFoundation component	Medium EPSS 2.31%	`>= 2.2.0, < 2.2.5`	`2.2.5`
GHSA-22pv-7v9j-hqxp Symfony Host Header Injection vulnerability in the HttpFoundation component	Medium EPSS 2.31%	`>= 2.1.0, < 2.1.12`	`2.1.12`
GHSA-22pv-7v9j-hqxp Symfony Host Header Injection vulnerability in the HttpFoundation component	Medium EPSS 2.31%	`>= 2.0.0, < 2.0.24`	`2.0.24`
GHSA-mcx4-f5f5-4859 Prevent cache poisoning via a Response Content-Type header in Symfony	Low EPSS 1.30%	`>= 4.4.0, < 4.4.7`	`4.4.7`
GHSA-mcx4-f5f5-4859 Prevent cache poisoning via a Response Content-Type header in Symfony	Low EPSS 1.30%	`>= 5.0.0, < 5.0.7`	`5.0.7`
GHSA-x92h-wmg2-6hp7 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony	Critical EPSS 1.87%	`>= 2.8.0, < 2.8.50`	`2.8.50`
GHSA-x92h-wmg2-6hp7 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony	Critical EPSS 1.87%	`>= 2.7.0, < 2.7.51`	`2.7.51`
GHSA-x92h-wmg2-6hp7 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony	Critical EPSS 1.87%	`>= 3.0.0, < 3.4.26`	`3.4.26`
GHSA-x92h-wmg2-6hp7 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony	Critical EPSS 1.87%	`>= 4.0.0, < 4.1.12`	`4.1.12`
GHSA-x92h-wmg2-6hp7 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony	Critical EPSS 1.87%	`>= 4.2.0, < 4.2.7`	`4.2.7`
GHSA-xhh6-956q-4q69 Argument injection in a MimeTypeGuesser in Symfony	High EPSS 2.25%	`>= 2.0.0, < 2.8.52`	`2.8.52`
GHSA-xhh6-956q-4q69 Argument injection in a MimeTypeGuesser in Symfony	High EPSS 2.25%	`>= 3.0.0, < 3.4.35`	`3.4.35`
GHSA-xhh6-956q-4q69 Argument injection in a MimeTypeGuesser in Symfony	High EPSS 2.25%	`>= 4.0.0, < 4.2.12`	`4.2.12`
GHSA-xhh6-956q-4q69 Argument injection in a MimeTypeGuesser in Symfony	High EPSS 2.25%	`>= 4.3.0, < 4.3.8`	`4.3.8`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor