VulnSea

symfony/http-kernel vulnerabilities

CVEs whose affected-version data names the symfony/http-kernel package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-123339Low· 2.3
2d ago

Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host…

▾ Sunlitsensiolabs · symfony/http-kernelEPSS 0.23%via CVEORG
symfony/http-kernel vulnerabilities (CVEs) · VulnSea