---
title: "symfony symfony/http-foundation vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/symfony/symfony-http-foundation
type: product
description: "symfony symfony/http-foundation has 11 published CVEs, 0 in CISA KEV and 0 with public exploits."
updated: 2026-10-15
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# symfony symfony/http-foundation vulnerabilities

Vendor: [symfony](https://radicalnotion.ai/vendor/symfony)

- **Published CVEs:** 11
- **In CISA KEV:** 0
- **With a public exploit:** 0
- **With a patch:** 11
- **Average CVSS:** 6.5
- **First CVE:** 2012-12-27
- **Latest CVE:** 2026-10-15
- **Ecosystems:** composer

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 1 |
| High | 3 |
| Medium | 6 |
| Low | 1 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 2 |
| [CWE-184](https://radicalnotion.ai/cwe/cwe-184) | Incomplete List of Disallowed Inputs | 1 |
| [CWE-264](https://radicalnotion.ai/cwe/cwe-264) | Permissions, Privileges, and Access Controls | 1 |
| [CWE-435](https://radicalnotion.ai/cwe/cwe-435) | Improper Interaction Between Multiple Correctly-Behaving Entities | 1 |
| [CWE-601](https://radicalnotion.ai/cwe/cwe-601) | URL Redirection to Untrusted Site ('Open Redirect') | 1 |
| [CWE-613](https://radicalnotion.ai/cwe/cwe-613) | Insufficient Session Expiration | 1 |
| [CWE-647](https://radicalnotion.ai/cwe/cwe-647) | Use of Non-Canonical URL Paths for Authorization Decisions | 1 |
| [CWE-1333](https://radicalnotion.ai/cwe/cwe-1333) | Inefficient Regular Expression Complexity | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2018 | 2 |
| 2019 | 2 |
| 2020 | 2 |
| 2021 | 0 |
| 2022 | 0 |
| 2023 | 0 |
| 2024 | 1 |
| 2025 | 1 |
| 2026 | 2 |

## Affected versions (top 24 of 92)

| Version | Kind | CVEs |
| --- | --- | --- |
| 2.0.0 \<= v \< 2.3.19 | range | 2 |
| 2.4.0 \<= v \< 2.4.9 | range | 2 |
| 2.5.0 \<= v \< 2.5.4 | range | 2 |
| \< 5.4.46 | range | 1 |
| \< 5.4.50 | range | 1 |
| 2.0.0 \<= v \< 2.0.19 | range | 1 |
| 2.0.0 \<= v \< 2.0.24 | range | 1 |
| 2.0.0 \<= v \< 2.3.27 | range | 1 |
| 2.0.0 \<= v \< 2.8.52 | range | 1 |
| 2.1.0 \<= v \< 2.1.12 | range | 1 |
| 2.2.0 \<= v \< 2.2.5 | range | 1 |
| 2.3.0 \<= v \< 2.3.3 | range | 1 |
| 2.3.19 | patched | 2 |
| 2.4.9 | patched | 2 |
| 2.5.4 | patched | 2 |
| 2.0.19 | patched | 1 |
| 2.0.24 | patched | 1 |
| 2.1.12 | patched | 1 |
| 2.2.5 | patched | 1 |
| 2.3.27 | patched | 1 |
| 2.3.3 | patched | 1 |
| 2.5.11 | patched | 1 |
| 2.6.6 | patched | 1 |
| 2.7.48 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-108082 | Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | high | 8.7 | No | No | Yes |
| CVE-2026-48736 | Symfony: IpUtils::PRIVATE\_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient | medium | 6.9 | No | No | Yes |
| CVE-2025-64500 | Symfony's incorrect parsing of PATH\_INFO can lead to limited authorization bypass | high | 7.3 | No | No | Yes |
| CVE-2024-50345 | Open redirect via browser-sanitized URLs in symfony/http-foundation | low | 2.3 | No | No | Yes |
| CVE-2020-5255 | Prevent cache poisoning via a Response Content-Type header | medium | 4.3 | No | No | Yes |
| CVE-2013-4752 | Symfony Host Header Injection vulnerability in the HttpFoundation component | medium | 6.1 | No | No | Yes |
| CVE-2019-18888 | Argument injection in a MimeTypeGuesser in Symfony | high | 7.5 | No | No | Yes |
| CVE-2019-10913 | Invalid HTTP method overrides allow possible XSS or other attacks in Symfony | critical | 9.8 | No | No | Yes |
| CVE-2018-14773 | Symfony HTTP Foundation web cache poisoning | medium | 6.5 | No | No | Yes |
| CVE-2018-11386 | Symfony DoS | medium | 5.9 | No | No | Yes |
| CVE-2012-6431 | Symfony Allows URI Restrictions Bypass Via Double-Encoded String | medium | 6.4 | No | No | Yes |

## Frequently asked questions

### How many CVEs does symfony symfony/http-foundation have?

symfony symfony/http-foundation has 11 published CVE records since 2012.

### How many symfony symfony/http-foundation CVEs are in CISA KEV?

None of symfony symfony/http-foundation's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for symfony symfony/http-foundation vulnerabilities?

No symfony symfony/http-foundation CVEs currently have a tracked public exploit in this dataset.

### Which versions of symfony symfony/http-foundation are affected?

92 distinct symfony symfony/http-foundation versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in symfony symfony/http-foundation CVEs?

symfony symfony/http-foundation's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-184 (Incomplete List of Disallowed Inputs), CWE-264 (Permissions, Privileges, and Access Controls), CWE-435 (Improper Interaction Between Multiple Correctly-Behaving Entities).

### How many critical symfony symfony/http-foundation vulnerabilities are there?

symfony symfony/http-foundation has 1 critical and 3 high-severity CVEs.

### What is the average severity of symfony symfony/http-foundation CVEs?

The average CVSS base score across symfony symfony/http-foundation's scored CVEs is 6.5.

## Other products from this vendor

- [symfony](https://radicalnotion.ai/vendor/symfony/symfony) (115 CVEs)
- [symfony/symfony](https://radicalnotion.ai/vendor/symfony/symfony-symfony) (96 CVEs)
- [twig](https://radicalnotion.ai/vendor/symfony/twig) (25 CVEs)
- [symfony/security-http](https://radicalnotion.ai/vendor/symfony/symfony-security-http) (19 CVEs)
- [symfony/security](https://radicalnotion.ai/vendor/symfony/symfony-security) (17 CVEs)
- [security-http](https://radicalnotion.ai/vendor/symfony/security-http) (11 CVEs)
- [ux](https://radicalnotion.ai/vendor/symfony/ux) (10 CVEs)
- [symfony/http-kernel](https://radicalnotion.ai/vendor/symfony/symfony-http-kernel) (8 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/symfony/symfony-http-foundation). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.