PHP package security
Is symfony/http-foundation vulnerable?
15 known security advisories for symfony/http-foundation. The latest was reported on 2026-09-15 and is fixed in 5.4.54, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.46, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.19, 8.1.0 and 8.1.7. The newest release, 8.1.10, is not affected by any of them.
1 critical 4 high 8 medium 2 low
- Known advisories
- 15
- Newest release
- 8.1.10
- Released
- 2026-10-27
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for symfony/http-foundation
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-09-15 | CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header CVE-2026-108082 · GitHub, FriendsOfPHP/security-advisories | high | >=5.4.1,<5.4.54 | >=6.0.1,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.46 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.19 | >=8.0.0,<8.1.0 | >=8.1.0,<8.1.7 | 5.4.54, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.46, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.19, 8.1.0, 8.1.7 |
| 2026-05-26 | CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient CVE-2026-48736 · GitHub, FriendsOfPHP/security-advisories | medium | >=6.4.0,<6.4.41 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.13 | >=8.0.0,<8.0.13 | 6.4.41, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.13, 8.0.13 |
| 2025-11-12 | CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass CVE-2025-64500 · GitHub, FriendsOfPHP/security-advisories | high | >=2.0.0,<3.0.0 | >=3.0.0,<4.0.0 | >=4.0.0,<5.0.0 | >=5.0.0,<5.1.0 | >=5.1.0,<5.2.0 | >=5.2.0,<5.3.0 | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.50 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.29 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.3.7 | 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.50, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.29, 7.1.0, 7.2.0, 7.3.0, 7.3.7 |
| 2024-11-05 | CVE-2024-50345: Open redirect via browser-sanitized URLs CVE-2024-50345 · GitHub, FriendsOfPHP/security-advisories | low | >=2.0.0,<3.0.0 | >=3.0.0,<4.0.0 | >=4.0.0,<5.0.0 | >=5.0.0,<5.1.0 | >=5.1.0,<5.2.0 | >=5.2.0,<5.3.0 | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.46 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.14 | >=7.0.0,<7.1.0 | >=7.1.0,<7.1.7 | 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.46, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.14, 7.1.0, 7.1.7 |
| 2020-03-30 | CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header CVE-2020-5255 · GitHub, FriendsOfPHP/security-advisories | low | >=4.4.0,<4.4.7 | >=5.0.0,<5.0.7 | 4.4.7, 5.0.7 |
| 2019-11-13 | CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser CVE-2019-18888 · GitHub, FriendsOfPHP/security-advisories | high | >=2.0.0,<2.1.0 | >=2.1.0,<2.2.0 | >=2.2.0,<2.3.0 | >=2.3.0,<2.4.0 | >=2.4.0,<2.5.0 | >=2.5.0,<2.6.0 | >=2.6.0,<2.7.0 | >=2.7.0,<2.8.0 | >=2.8.0,<2.8.52 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.3.0 | >=3.3.0,<3.4.0 | >=3.4.0,<3.4.35 | >=4.0.0,<4.1.0 | >=4.1.0,<4.2.0 | >=4.2.0,<4.2.12 | >=4.3.0,<4.3.8 | 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.8.52, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.35, 4.1.0, 4.2.0, 4.2.12, 4.3.8 |
| 2019-04-16 | CVE-2019-10913: Reject invalid HTTP method overrides CVE-2019-10913 · GitHub, FriendsOfPHP/security-advisories | critical | >=2.7.0,<2.7.51 | >=2.8.0,<2.8.50 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.3.0 | >=3.3.0,<3.4.0 | >=3.4.0,<3.4.26 | >=4.0.0,<4.1.0 | >=4.1.0,<4.1.12 | >=4.2.0,<4.2.7 | 2.7.51, 2.8.50, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.26, 4.1.0, 4.1.12, 4.2.7 |
| 2018-08-01 | CVE-2018-14773: Remove support for legacy and risky HTTP headers CVE-2018-14773 · GitHub, FriendsOfPHP/security-advisories | medium | >=2.0.0,<2.1.0 | >=2.1.0,<2.2.0 | >=2.2.0,<2.3.0 | >=2.3.0,<2.4.0 | >=2.4.0,<2.5.0 | >=2.5.0,<2.6.0 | >=2.6.0,<2.7.0 | >=2.7.0,<2.7.49 | >=2.8.0,<2.8.44 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.3.0 | >=3.3.0,<3.3.18 | >=3.4.0,<3.4.14 | >=4.0.0,<4.0.14 | >=4.1.0,<4.1.3 | 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.6.0, 2.7.0, 2.7.49, 2.8.44, 3.1.0, 3.2.0, 3.3.0, 3.3.18, 3.4.14, 4.0.14, 4.1.3 |
| 2018-05-25 | CVE-2018-11386: Denial of service when using PDOSessionHandler CVE-2018-11386 · GitHub, FriendsOfPHP/security-advisories | medium | >=2.0.0,<2.1.0 | >=2.1.0,<2.2.0 | >=2.2.0,<2.3.0 | >=2.3.0,<2.4.0 | >=2.4.0,<2.5.0 | >=2.5.0,<2.6.0 | >=2.6.0,<2.7.0 | >=2.7.0,<2.7.48 | >=2.8.0,<2.8.41 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.3.0 | >=3.3.0,<3.3.17 | >=3.4.0,<3.4.11 | >=4.0.0,<4.0.11 | 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.6.0, 2.7.0, 2.7.48, 2.8.41, 3.1.0, 3.2.0, 3.3.0, 3.3.17, 3.4.11, 4.0.11 |
| 2015-04-01 | Unsafe methods in the Request class CVE-2015-2309 · GitHub, FriendsOfPHP/security-advisories | medium | >=2.0.0,<2.1.0 | >=2.1.0,<2.2.0 | >=2.2.0,<2.3.0 | >=2.3.0,<2.3.27 | >=2.4.0,<2.5.0 | >=2.5.0,<2.5.11 | >=2.6.0,<2.6.6 | 2.1.0, 2.2.0, 2.3.0, 2.3.27, 2.5.0, 2.5.11, 2.6.6 |
| 2014-09-03 | Security issue when parsing the Authorization header CVE-2014-6061 · GitHub, FriendsOfPHP/security-advisories | medium | >=2.0.0,<2.1.0 | >=2.1.0,<2.2.0 | >=2.2.0,<2.3.0 | >=2.3.0,<2.3.19 | >=2.4.0,<2.4.9 | >=2.5.0,<2.5.4 | 2.1.0, 2.2.0, 2.3.0, 2.3.19, 2.4.9, 2.5.4 |
| 2014-09-03 | Denial of service with a malicious HTTP Host header CVE-2014-5244 · GitHub, FriendsOfPHP/security-advisories | high | >=2.0.0,<2.1.0 | >=2.1.0,<2.2.0 | >=2.2.0,<2.3.0 | >=2.3.0,<2.3.19 | >=2.4.0,<2.4.9 | >=2.5.0,<2.5.4 | 2.1.0, 2.2.0, 2.3.0, 2.3.19, 2.4.9, 2.5.4 |
| 2013-08-17 | Request::getHost() poisoning CVE-2013-4752 · GitHub, FriendsOfPHP/security-advisories | medium | >=2.0.0,<2.0.24 | >=2.1.0,<2.1.12 | >=2.2.0,<2.2.5 | >=2.3.0,<2.3.3 | 2.0.24, 2.1.12, 2.2.5, 2.3.3 |
| 2012-11-29 | Request::getClientIp() when the trust proxy mode is enabled Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=2.0.0,<2.0.19 | >=2.1.0,<2.1.4 | 2.0.19, 2.1.4 |
| 2012-03-19 | Routes behind a firewall are accessible even when not logged in CVE-2012-6431 · GitHub, FriendsOfPHP/security-advisories | medium | >=2.0.0,<2.0.19 | 2.0.19 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about symfony/http-foundation
Does symfony/http-foundation have known vulnerabilities?
Yes. Packagist lists 15 security advisories for symfony/http-foundation (1 critical, 4 high, 8 medium, 2 low severity). The most recent, reported 2026-09-15, is "CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header". The newest release, 8.1.10, is outside every affected range.
Which version of symfony/http-foundation should I run?
The newest stable release is 8.1.10 (published 2026-10-27). The most recent advisory is fixed in 5.4.54, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.46, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.19, 8.1.0 and 8.1.7, so stay on or above the fixed version for your major version. Run composer update symfony/http-foundation, then composer audit to confirm nothing else is flagged.
How do I check if my symfony/http-foundation version is affected?
Run composer show symfony/http-foundation in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.