--- title: "symfony security-http vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/symfony/security-http type: product description: "symfony security-http has 11 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-07-14 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # symfony security-http vulnerabilities Vendor: [symfony](https://radicalnotion.ai/vendor/symfony) - **Published CVEs:** 11 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 11 - **Average CVSS:** 7.3 - **First CVE:** 2021-06-17 - **Latest CVE:** 2026-07-14 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 7 | | Medium | 3 | | Low | 1 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 2 | | [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 2 | | [CWE-345](https://radicalnotion.ai/cwe/cwe-345) | Insufficient Verification of Data Authenticity | 1 | | [CWE-184](https://radicalnotion.ai/cwe/cwe-184) | Incomplete List of Disallowed Inputs | 1 | | [CWE-436](https://radicalnotion.ai/cwe/cwe-436) | Interpretation Conflict | 1 | | [CWE-451](https://radicalnotion.ai/cwe/cwe-451) | User Interface (UI) Misrepresentation of Critical Information | 1 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 1 | | [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2021 | 1 | | 2022 | 0 | | 2023 | 0 | | 2024 | 0 | | 2025 | 0 | | 2026 | 10 | ## Affected versions (top 12 of 162) | Version | Kind | CVEs | | --- | --- | --- | | 8.0.0 | exact | 7 | | 8.0.1 | exact | 7 | | 8.0.10 | exact | 7 | | 8.0.11 | exact | 7 | | 8.0.2 | exact | 7 | | 8.0.3 | exact | 7 | | 8.0.4 | exact | 7 | | 8.0.5 | exact | 7 | | 8.0.6 | exact | 7 | | 8.0.7 | exact | 7 | | 8.0.8 | exact | 7 | | 8.0.9 | exact | 7 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-48761 | Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on , , , and the URL Inside content | medium | 5.3 | No | No | Yes | | CVE-2026-48489 | Symfony: Security Firewall Bypass via failure\_forward Subrequest: Unauthenticated Access to access\_control-Protected GET Routes | high | 8.7 | No | No | Yes | | CVE-2026-45754 | Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection | medium | 6.9 | No | No | Yes | | CVE-2026-45069 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | high | 8.8 | No | No | Yes | | CVE-2026-45075 | Symfony: HEAD Request Bypasses methods: \['GET'\] Filter in #\[IsGranted\] / #\[IsSignatureValid\] / #\[IsCsrfTokenValid\] | high | 8.6 | No | No | Yes | | CVE-2026-47767 | Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP\_ENV/APP\_DEBUG via parse\_str/SAPI Argv Mismatch | high | 8.3 | No | No | Yes | | CVE-2026-45064 | Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing | medium | 6.9 | No | No | Yes | | CVE-2026-45756 | Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS | high | 8.2 | No | No | Yes | | CVE-2026-45066 | Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and Misclassification | low | 2.3 | No | No | Yes | | CVE-2026-45074 | Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay | high | 7.6 | No | No | Yes | | CVE-2021-32693 | Authentication granted with multiple firewalls | high | 8.8 | No | No | Yes | ## Frequently asked questions ### How many CVEs does symfony security-http have? symfony security-http has 11 published CVE records since 2021. ### How many symfony security-http CVEs are in CISA KEV? None of symfony security-http's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for symfony security-http vulnerabilities? No symfony security-http CVEs currently have a tracked public exploit in this dataset. ### Which versions of symfony security-http are affected? 162 distinct symfony security-http versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in symfony security-http CVEs? symfony security-http's CVEs most often map to these CWE weakness types: CWE-287 (Improper Authentication), CWE-863 (Incorrect Authorization), CWE-345 (Insufficient Verification of Data Authenticity), CWE-184 (Incomplete List of Disallowed Inputs). ### What is the average severity of symfony security-http CVEs? The average CVSS base score across symfony security-http's scored CVEs is 7.3. ## Other products from this vendor - [symfony](https://radicalnotion.ai/vendor/symfony/symfony) (115 CVEs) - [symfony/symfony](https://radicalnotion.ai/vendor/symfony/symfony-symfony) (96 CVEs) - [twig](https://radicalnotion.ai/vendor/symfony/twig) (25 CVEs) - [symfony/security-http](https://radicalnotion.ai/vendor/symfony/symfony-security-http) (19 CVEs) - [symfony/security](https://radicalnotion.ai/vendor/symfony/symfony-security) (17 CVEs) - [symfony/http-foundation](https://radicalnotion.ai/vendor/symfony/symfony-http-foundation) (14 CVEs) - [ux](https://radicalnotion.ai/vendor/symfony/ux) (10 CVEs) - [symfony/http-kernel](https://radicalnotion.ai/vendor/symfony/symfony-http-kernel) (8 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/symfony/security-http). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.