---
title: "symfony symfony/security-http vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/symfony/symfony-security-http
type: product
description: "symfony symfony/security-http has 19 published CVEs, 0 in CISA KEV and 0 with public exploits."
updated: 2026-07-14
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# symfony symfony/security-http vulnerabilities

Vendor: [symfony](https://radicalnotion.ai/vendor/symfony)

- **Published CVEs:** 19
- **In CISA KEV:** 0
- **With a public exploit:** 0
- **With a patch:** 19
- **Average CVSS:** 7.4
- **First CVE:** 2015-12-07
- **Latest CVE:** 2026-07-14
- **Ecosystems:** composer

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 1 |
| High | 12 |
| Medium | 5 |
| Low | 1 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 3 |
| [CWE-290](https://radicalnotion.ai/cwe/cwe-290) | Authentication Bypass by Spoofing | 2 |
| [CWE-384](https://radicalnotion.ai/cwe/cwe-384) | Session Fixation | 2 |
| [CWE-601](https://radicalnotion.ai/cwe/cwe-601) | URL Redirection to Untrusted Site ('Open Redirect') | 2 |
| [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 2 |
| [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 1 |
| [CWE-345](https://radicalnotion.ai/cwe/cwe-345) | Insufficient Verification of Data Authenticity | 1 |
| [CWE-203](https://radicalnotion.ai/cwe/cwe-203) | Observable Discrepancy | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2015 | 2 |
| 2016 | 1 |
| 2017 | 0 |
| 2018 | 4 |
| 2019 | 2 |
| 2020 | 1 |
| 2021 | 2 |
| 2022 | 0 |
| 2023 | 1 |
| 2024 | 1 |
| 2025 | 0 |
| 2026 | 5 |

## Affected versions (top 24 of 94)

| Version | Kind | CVEs |
| --- | --- | --- |
| 8.0.0 \<= v \< 8.0.12 | range | 3 |
| 2.4.0 \<= v \< 2.6.12 | range | 2 |
| 2.7.0 \<= v \< 2.7.48 | range | 2 |
| 2.7.0 \<= v \< 2.7.7 | range | 2 |
| 2.8.0 \<= v \< 2.8.41 | range | 2 |
| 3.0.0 \<= v \< 3.3.17 | range | 2 |
| 3.4.0 \<= v \< 3.4.11 | range | 2 |
| 4.0.0 \<= v \< 4.0.11 | range | 2 |
| 7.4.0 \<= v \< 7.4.12 | range | 2 |
| \< 5.4.52 | range | 1 |
| \< 5.4.53 | range | 1 |
| 2.3.0 \<= v \< 2.3.41 | range | 1 |
| 7.4.12 | patched | 4 |
| 8.0.12 | patched | 4 |
| 2.6.12 | patched | 2 |
| 2.7.48 | patched | 2 |
| 2.7.7 | patched | 2 |
| 2.8.41 | patched | 2 |
| 3.3.17 | patched | 2 |
| 3.4.11 | patched | 2 |
| 4.0.11 | patched | 2 |
| 6.4.40 | patched | 2 |
| 2.3.41 | patched | 1 |
| 2.7.13 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-48489 | Symfony: Security Firewall Bypass via failure\_forward Subrequest: Unauthenticated Access to access\_control-Protected GET Routes | high | 8.7 | No | No | Yes |
| CVE-2026-45069 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | high | 8.8 | No | No | Yes |
| CVE-2026-45075 | Symfony: HEAD Request Bypasses methods: \['GET'\] Filter in #\[IsGranted\] / #\[IsSignatureValid\] / #\[IsCsrfTokenValid\] | high | 8.6 | No | No | Yes |
| CVE-2026-45063 | Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator | critical | 9.1 | No | No | Yes |
| CVE-2026-45074 | Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay | high | 7.6 | No | No | Yes |
| CVE-2024-51996 | Symphony has an Authentication Bypass via RememberMe | high | 8.7 | No | No | Yes |
| CVE-2023-46733 | Symfony possible session fixation vulnerability | medium | 6.5 | No | No | Yes |
| CVE-2021-32693 | Authentication granted with multiple firewalls | high | 8.8 | No | No | Yes |
| CVE-2021-21424 | Prevent user enumeration using Guard or the new Authenticator-based Security | medium | 5.3 | No | No | Yes |
| CVE-2020-5275 | Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http | high | 8.1 | No | No | Yes |
| CVE-2019-18886 | User enumeration leak using switch user functionality in Symfony | medium | 5.3 | No | No | Yes |
| CVE-2019-10911 | Improper authentication in Symfony | high | 7.5 | No | No | Yes |
| CVE-2018-19790 | Symfony Open Redirect | medium | 6.1 | No | No | Yes |
| CVE-2018-11406 | Symfony CSRF Token Fixation | high | 8.8 | No | No | Yes |
| CVE-2018-11385 | Symfony Session Fixation Vulnerability | high | 8.1 | No | No | Yes |
| CVE-2017-16652 | Symfony Open Redirect | medium | 6.1 | No | No | Yes |
| CVE-2016-4423 | Symphony Denial of Service Via Overlong Usernames | high | 7.5 | No | No | Yes |
| CVE-2015-8125 | Symfony Vulnerable to Timing Attack | high | 7.5 | No | No | Yes |
| CVE-2015-8124 | Symfony Session Fixation Vulnerability | low | 3.1 | No | No | Yes |

## Frequently asked questions

### How many CVEs does symfony symfony/security-http have?

symfony symfony/security-http has 19 published CVE records since 2015.

### How many symfony symfony/security-http CVEs are in CISA KEV?

None of symfony symfony/security-http's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for symfony symfony/security-http vulnerabilities?

No symfony symfony/security-http CVEs currently have a tracked public exploit in this dataset.

### Which versions of symfony symfony/security-http are affected?

94 distinct symfony symfony/security-http versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in symfony symfony/security-http CVEs?

symfony symfony/security-http's CVEs most often map to these CWE weakness types: CWE-287 (Improper Authentication), CWE-290 (Authentication Bypass by Spoofing), CWE-384 (Session Fixation), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).

### How many critical symfony symfony/security-http vulnerabilities are there?

symfony symfony/security-http has 1 critical and 12 high-severity CVEs.

### What is the average severity of symfony symfony/security-http CVEs?

The average CVSS base score across symfony symfony/security-http's scored CVEs is 7.4.

## Other products from this vendor

- [symfony](https://radicalnotion.ai/vendor/symfony/symfony) (115 CVEs)
- [symfony/symfony](https://radicalnotion.ai/vendor/symfony/symfony-symfony) (96 CVEs)
- [twig](https://radicalnotion.ai/vendor/symfony/twig) (25 CVEs)
- [symfony/security](https://radicalnotion.ai/vendor/symfony/symfony-security) (17 CVEs)
- [symfony/http-foundation](https://radicalnotion.ai/vendor/symfony/symfony-http-foundation) (14 CVEs)
- [security-http](https://radicalnotion.ai/vendor/symfony/security-http) (11 CVEs)
- [ux](https://radicalnotion.ai/vendor/symfony/ux) (10 CVEs)
- [symfony/http-kernel](https://radicalnotion.ai/vendor/symfony/symfony-http-kernel) (8 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/symfony/symfony-security-http). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.