---
title: "symfony symfony/http-kernel vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/symfony/symfony-http-kernel
type: product
description: "symfony symfony/http-kernel has 7 published CVEs, 0 in CISA KEV and 0 with public exploits."
updated: 2026-07-14
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# symfony symfony/http-kernel vulnerabilities

Vendor: [symfony](https://radicalnotion.ai/vendor/symfony)

- **Published CVEs:** 7
- **In CISA KEV:** 0
- **With a public exploit:** 0
- **With a patch:** 7
- **Average CVSS:** 7.4
- **First CVE:** 2015-06-02
- **Latest CVE:** 2026-07-14
- **Ecosystems:** composer

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 0 |
| High | 4 |
| Medium | 3 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-203](https://radicalnotion.ai/cwe/cwe-203) | Observable Discrepancy | 1 |
| [CWE-212](https://radicalnotion.ai/cwe/cwe-212) | Improper Removal of Sensitive Information Before Storage or Transfer | 1 |
| [CWE-284](https://radicalnotion.ai/cwe/cwe-284) | Improper Access Control | 1 |
| [CWE-285](https://radicalnotion.ai/cwe/cwe-285) | Improper Authorization | 1 |
| [CWE-444](https://radicalnotion.ai/cwe/cwe-444) | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | 1 |
| [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 1 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2015 | 2 |
| 2016 | 0 |
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 1 |
| 2020 | 1 |
| 2021 | 1 |
| 2022 | 0 |
| 2023 | 1 |
| 2024 | 0 |
| 2025 | 0 |
| 2026 | 1 |

## Affected versions (top 24 of 47)

| Version | Kind | CVEs |
| --- | --- | --- |
| 2.0.0 \<= v \< 2.3.19 | range | 1 |
| 2.0.0 \<= v \< 2.3.27 | range | 1 |
| 2.0.0 \<= v \< 4.4.50 | range | 1 |
| 2.2.0 \<= v \< 2.8.52 | range | 1 |
| 2.3.19 \<= v \< 2.3.29 | range | 1 |
| 2.4.0 \<= v \< 2.4.9 | range | 1 |
| 2.4.0 \<= v \< 2.5.11 | range | 1 |
| 2.4.9 \<= v \<= 2.4.10 | range | 1 |
| 2.5.0 \<= v \< 2.5.4 | range | 1 |
| 2.5.4 \<= v \< 2.5.12 | range | 1 |
| 2.6.0 \<= v \< 2.6.6 | range | 1 |
| 2.6.0 \<= v \< 2.6.8 | range | 1 |
| 2.3.19 | patched | 1 |
| 2.3.27 | patched | 1 |
| 2.3.29 | patched | 1 |
| 2.4.9 | patched | 1 |
| 2.5.11 | patched | 1 |
| 2.5.12 | patched | 1 |
| 2.5.4 | patched | 1 |
| 2.6.6 | patched | 1 |
| 2.6.8 | patched | 1 |
| 2.8.52 | patched | 1 |
| 3.4.35 | patched | 1 |
| 4.2.12 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-45075 | Symfony: HEAD Request Bypasses methods: \['GET'\] Filter in #\[IsGranted\] / #\[IsSignatureValid\] / #\[IsCsrfTokenValid\] | high | 8.6 | No | No | Yes |
| CVE-2022-24894 | Symfony storing cookie headers in HttpCache | high | 8.8 | No | No | Yes |
| CVE-2021-41267 | Webcache Poisoning in Symfony | medium | 6.5 | No | No | Yes |
| CVE-2020-15094 | RCE in Symfony | high | 8.8 | No | No | Yes |
| CVE-2019-18887 | Symfony Http-Kernel has non-constant time comparison in UriSigner | high | 8.1 | No | No | Yes |
| CVE-2015-2308 | Symfony Vulnerable to PHP Eval Injection | medium | 6.8 | No | No | Yes |
| CVE-2015-4050 | Symfony Incorrect Access Control | medium | 4.3 | No | No | Yes |

## Frequently asked questions

### How many CVEs does symfony symfony/http-kernel have?

symfony symfony/http-kernel has 7 published CVE records since 2015.

### How many symfony symfony/http-kernel CVEs are in CISA KEV?

None of symfony symfony/http-kernel's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for symfony symfony/http-kernel vulnerabilities?

No symfony symfony/http-kernel CVEs currently have a tracked public exploit in this dataset.

### Which versions of symfony symfony/http-kernel are affected?

47 distinct symfony symfony/http-kernel versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in symfony symfony/http-kernel CVEs?

symfony symfony/http-kernel's CVEs most often map to these CWE weakness types: CWE-203 (Observable Discrepancy), CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer), CWE-284 (Improper Access Control), CWE-285 (Improper Authorization).

### What is the average severity of symfony symfony/http-kernel CVEs?

The average CVSS base score across symfony symfony/http-kernel's scored CVEs is 7.4.

## Other products from this vendor

- [symfony](https://radicalnotion.ai/vendor/symfony/symfony) (115 CVEs)
- [symfony/symfony](https://radicalnotion.ai/vendor/symfony/symfony-symfony) (96 CVEs)
- [twig](https://radicalnotion.ai/vendor/symfony/twig) (25 CVEs)
- [symfony/security-http](https://radicalnotion.ai/vendor/symfony/symfony-security-http) (19 CVEs)
- [symfony/security](https://radicalnotion.ai/vendor/symfony/symfony-security) (17 CVEs)
- [symfony/http-foundation](https://radicalnotion.ai/vendor/symfony/symfony-http-foundation) (14 CVEs)
- [security-http](https://radicalnotion.ai/vendor/symfony/security-http) (11 CVEs)
- [ux](https://radicalnotion.ai/vendor/symfony/ux) (10 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/symfony/symfony-http-kernel). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.