PHP package security
Is symfony/security-http vulnerable?
20 known security advisories for symfony/security-http. The latest was reported on 2026-05-26 and is fixed in 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.53, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.41, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.13 and 8.0.13. The newest release, 8.1.10, is not affected by any of them.
10 high 8 medium 2 low
- Known advisories
- 20
- Newest release
- 8.1.10
- Released
- 2026-10-28
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for symfony/security-http
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-05-26 | CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes CVE-2026-48489 · GitHub, FriendsOfPHP/security-advisories | high | >=2.0.0,<3.0.0 | >=3.0.0,<4.0.0 | >=4.0.0,<5.0.0 | >=5.0.0,<5.1.0 | >=5.1.0,<5.2.0 | >=5.2.0,<5.3.0 | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.53 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.41 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.13 | >=8.0.0,<8.0.13 | 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.53, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.41, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.13, 8.0.13 |
| 2026-05-20 | CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator CVE-2026-45063 · GitHub, FriendsOfPHP/security-advisories | high | >=2.0.0,<3.0.0 | >=3.0.0,<4.0.0 | >=4.0.0,<5.0.0 | >=5.0.0,<5.1.0 | >=5.1.0,<5.2.0 | >=5.2.0,<5.3.0 | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.52 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.40 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.12 | >=8.0.0,<8.0.12 | 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.52, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.40, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.12, 8.0.12 |
| 2026-05-20 | CVE-2026-45069: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims CVE-2026-45069 · GitHub, FriendsOfPHP/security-advisories | medium | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.40 | >=7.4.0,<7.4.12 | >=8.0.0,<8.0.12 | 6.4.0, 6.4.40, 7.4.12, 8.0.12 |
| 2026-05-20 | CVE-2026-45074: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay CVE-2026-45074 · GitHub, FriendsOfPHP/security-advisories | medium | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.12 | >=8.0.0,<8.0.12 | 7.2.0, 7.3.0, 7.4.0, 7.4.12, 8.0.12 |
| 2026-05-20 | CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] CVE-2026-45075 · GitHub, FriendsOfPHP/security-advisories | high | >=7.4.0,<7.4.12 | >=8.0.0,<8.0.12 | 7.4.12, 8.0.12 |
| 2024-11-13 | CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie CVE-2024-51996 · GitHub, FriendsOfPHP/security-advisories | high | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.47 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.15 | >=7.0.0,<7.1.0 | >=7.1.0,<7.1.8 | 5.4.0, 5.4.47, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.15, 7.1.0, 7.1.8 |
| 2023-11-10 | CVE-2023-46733: Possible session fixation CVE-2023-46733 · GitHub, FriendsOfPHP/security-advisories | medium | >=5.4.0,<5.4.31 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.3.8 | 5.4.31, 6.1.0, 6.2.0, 6.3.0, 6.3.8 |
| 2021-06-17 | CVE-2021-32693: Authentication granted to all firewalls instead of just one CVE-2021-32693 · GitHub, FriendsOfPHP/security-advisories | medium | >=5.3.0,<5.3.2 | 5.3.2 |
| 2021-05-17 | User enumeration in authentication mechanisms GHSA-g2qj-pmxm-9f8f · GitHub | low | >=5.1.0,<5.2.8 | 5.2.8 |
| 2021-05-12 | CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms CVE-2021-21424 · GitHub, FriendsOfPHP/security-advisories | medium | >=5.1.0,<5.2.0 | >=5.2.0,<5.2.8 | 5.2.0, 5.2.8 |
| 2020-03-30 | CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy CVE-2020-5275 · GitHub, FriendsOfPHP/security-advisories | high | >=4.4.0,<4.4.7 | >=5.0.0,<5.0.7 | 4.4.7, 5.0.7 |
| 2019-11-13 | CVE-2019-18886: Prevent user enumeration using switch user functionality CVE-2019-18886 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.1.0,<4.2.0 | >=4.2.0,<4.2.12 | >=4.3.0,<4.3.8 | 4.2.0, 4.2.12, 4.3.8 |
| 2019-04-16 | CVE-2019-10911: Add a separator in the remember me cookie hash CVE-2019-10911 · GitHub, FriendsOfPHP/security-advisories | high | >=2.7.0,<2.7.51 | >=2.8.0,<2.8.50 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.3.0 | >=3.3.0,<3.4.0 | >=3.4.0,<3.4.26 | >=4.0.0,<4.1.0 | >=4.1.0,<4.1.12 | >=4.2.0,<4.2.7 | 2.7.51, 2.8.50, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.26, 4.1.0, 4.1.12, 4.2.7 |
| 2018-11-06 | CVE-2018-19790: Open Redirect Vulnerability on login CVE-2018-19790 · GitHub, FriendsOfPHP/security-advisories | medium | >=2.7.38,<2.7.50 | >=2.8.0,<2.8.49 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.3.0 | >=3.3.0,<3.4.0 | >=3.4.0,<3.4.20 | >=4.0.0,<4.0.15 | >=4.1.0,<4.1.9 | >=4.2.0,<4.2.1 | 2.7.50, 2.8.49, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.20, 4.0.15, 4.1.9, 4.2.1 |
| 2018-05-25 | CVE-2018-11385: Session Fixation Issue for Guard Authentication CVE-2018-11385 · GitHub, FriendsOfPHP/security-advisories | high | >=2.4.0,<2.7.48 | >=2.5.0,<2.7.48 | >=2.6.0,<2.7.48 | >=2.7.0,<2.7.48 | >=2.8.0,<2.8.41 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.3.0 | >=3.3.0,<3.3.17 | >=3.4.0,<3.4.11 | >=4.0.0,<4.0.11 | 2.7.48, 2.8.41, 3.1.0, 3.2.0, 3.3.0, 3.3.17, 3.4.11, 4.0.11 |
| 2018-05-25 | CVE-2018-11406: CSRF Token Fixation CVE-2018-11406 · GitHub, FriendsOfPHP/security-advisories | high | >=2.4.0,<2.7.48 | >=2.5.0,<2.7.48 | >=2.6.0,<2.7.48 | >=2.7.0,<2.7.48 | >=2.8.0,<2.8.41 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.3.0 | >=3.3.0,<3.3.17 | >=3.4.0,<3.4.11 | >=4.0.0,<4.0.11 | 2.7.48, 2.8.41, 3.1.0, 3.2.0, 3.3.0, 3.3.17, 3.4.11, 4.0.11 |
| 2017-11-16 | CVE-2017-16652: Open redirect vulnerability on security handlers CVE-2017-16652 · GitHub, FriendsOfPHP/security-advisories | medium | >=2.7.0,<2.7.38 | >=2.8.0,<2.8.31 | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.2.14 | >=3.3.0,<3.3.13 | 2.7.38, 2.8.31, 3.1.0, 3.2.0, 3.2.14, 3.3.13 |
| 2016-05-09 | CVE-2016-4423: Large username storage in session CVE-2016-4423 · GitHub, FriendsOfPHP/security-advisories | high | >=2.3.0,<2.3.41 | >=2.4.0,<2.5.0 | >=2.5.0,<2.6.0 | >=2.6.0,<2.7.0 | >=2.7.0,<2.7.13 | >=2.8.0,<2.8.6 | >=3.0.0,<3.0.6 | 2.3.41, 2.5.0, 2.6.0, 2.7.0, 2.7.13, 2.8.6, 3.0.6 |
| 2015-11-23 | CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature CVE-2015-8124 · GitHub, FriendsOfPHP/security-advisories | low | >=2.4.0,<2.5.0 | >=2.5.0,<2.6.0 | >=2.6.0,<2.6.12 | >=2.7.0,<2.7.7 | 2.5.0, 2.6.0, 2.6.12, 2.7.7 |
| 2015-11-23 | CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service CVE-2015-8125 · GitHub, FriendsOfPHP/security-advisories | high | >=2.4.0,<2.5.0 | >=2.5.0,<2.6.0 | >=2.6.0,<2.6.12 | >=2.7.0,<2.7.7 | 2.5.0, 2.6.0, 2.6.12, 2.7.7 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about symfony/security-http
Does symfony/security-http have known vulnerabilities?
Yes. Packagist lists 20 security advisories for symfony/security-http (10 high, 8 medium, 2 low severity). The most recent, reported 2026-05-26, is "CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes". The newest release, 8.1.10, is outside every affected range.
Which version of symfony/security-http should I run?
The newest stable release is 8.1.10 (published 2026-10-28). The most recent advisory is fixed in 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.53, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.41, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.13 and 8.0.13, so stay on or above the fixed version for your major version. Run composer update symfony/security-http, then composer audit to confirm nothing else is flagged.
How do I check if my symfony/security-http version is affected?
Run composer show symfony/security-http in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.