{"advisories":{"symfony\/http-foundation":[{"advisoryId":"PKSA-xmwy-rmx5-m7h4","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml"}]},{"advisoryId":"PKSA-y6py-qpv1-h52p","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2026-48736.yaml","title":"CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient","link":"https:\/\/symfony.com\/cve-2026-48736","cve":"CVE-2026-48736","affectedVersions":"\u003E=6.4.0,\u003C6.4.41|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.13|\u003E=8.0.0,\u003C8.0.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-05-26 08:00:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-38cx-cq6f-5755"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2026-48736.yaml"}]},{"advisoryId":"PKSA-365x-2zjk-pt47","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2025-64500.yaml","title":"CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass","link":"https:\/\/symfony.com\/blog\/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass","cve":"CVE-2025-64500","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.50|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.29|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.3.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2025-11-12 11:09:14","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-3rg7-wf37-54rm"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2025-64500.yaml"}]},{"advisoryId":"PKSA-b35n-565h-rs4q","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2024-50345.yaml","title":"CVE-2024-50345: Open redirect via browser-sanitized URLs","link":"https:\/\/symfony.com\/cve-2024-50345","cve":"CVE-2024-50345","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.46|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.14|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-05 08:00:00","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-mrqx-rp3w-jpjp"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2024-50345.yaml"}]},{"advisoryId":"PKSA-t4rz-hp2g-57t1","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2020-5255.yaml","title":"CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header","link":"https:\/\/symfony.com\/cve-2020-5255","cve":"CVE-2020-5255","affectedVersions":"\u003E=4.4.0,\u003C4.4.7|\u003E=5.0.0,\u003C5.0.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2020-03-30 14:00:00","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-mcx4-f5f5-4859"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2020-5255.yaml"}]},{"advisoryId":"PKSA-9w98-4rwq-spxr","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2019-18888.yaml","title":"CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser","link":"https:\/\/symfony.com\/cve-2019-18888","cve":"CVE-2019-18888","affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.2.0|\u003E=2.2.0,\u003C2.3.0|\u003E=2.3.0,\u003C2.4.0|\u003E=2.4.0,\u003C2.5.0|\u003E=2.5.0,\u003C2.6.0|\u003E=2.6.0,\u003C2.7.0|\u003E=2.7.0,\u003C2.8.0|\u003E=2.8.0,\u003C2.8.52|\u003E=3.0.0,\u003C3.1.0|\u003E=3.1.0,\u003C3.2.0|\u003E=3.2.0,\u003C3.3.0|\u003E=3.3.0,\u003C3.4.0|\u003E=3.4.0,\u003C3.4.35|\u003E=4.0.0,\u003C4.1.0|\u003E=4.1.0,\u003C4.2.0|\u003E=4.2.0,\u003C4.2.12|\u003E=4.3.0,\u003C4.3.8","source":"FriendsOfPHP\/security-advisories","reportedAt":"2019-11-13 08:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-xhh6-956q-4q69"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2019-18888.yaml"}]},{"advisoryId":"PKSA-324d-pqmd-hptz","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2019-10913.yaml","title":"CVE-2019-10913: Reject invalid HTTP method overrides","link":"https:\/\/symfony.com\/cve-2019-10913","cve":"CVE-2019-10913","affectedVersions":"\u003E=2.7.0,\u003C2.7.51|\u003E=2.8.0,\u003C2.8.50|\u003E=3.0.0,\u003C3.1.0|\u003E=3.1.0,\u003C3.2.0|\u003E=3.2.0,\u003C3.3.0|\u003E=3.3.0,\u003C3.4.0|\u003E=3.4.0,\u003C3.4.26|\u003E=4.0.0,\u003C4.1.0|\u003E=4.1.0,\u003C4.1.12|\u003E=4.2.0,\u003C4.2.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2019-04-16 10:45:11","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-x92h-wmg2-6hp7"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2019-10913.yaml"}]},{"advisoryId":"PKSA-nqj4-v43p-2gxc","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2018-14773.yaml","title":"CVE-2018-14773: Remove support for legacy and risky HTTP headers","link":"https:\/\/symfony.com\/blog\/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers","cve":"CVE-2018-14773","affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.2.0|\u003E=2.2.0,\u003C2.3.0|\u003E=2.3.0,\u003C2.4.0|\u003E=2.4.0,\u003C2.5.0|\u003E=2.5.0,\u003C2.6.0|\u003E=2.6.0,\u003C2.7.0|\u003E=2.7.0,\u003C2.7.49|\u003E=2.8.0,\u003C2.8.44|\u003E=3.0.0,\u003C3.1.0|\u003E=3.1.0,\u003C3.2.0|\u003E=3.2.0,\u003C3.3.0|\u003E=3.3.0,\u003C3.3.18|\u003E=3.4.0,\u003C3.4.14|\u003E=4.0.0,\u003C4.0.14|\u003E=4.1.0,\u003C4.1.3","source":"FriendsOfPHP\/security-advisories","reportedAt":"2018-08-01 15:57:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-8wgj-6wx8-h5hq"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2018-14773.yaml"}]},{"advisoryId":"PKSA-f8b8-pbjy-s9k8","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2018-11386.yaml","title":"CVE-2018-11386: Denial of service when using PDOSessionHandler","link":"https:\/\/symfony.com\/cve-2018-11386","cve":"CVE-2018-11386","affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.2.0|\u003E=2.2.0,\u003C2.3.0|\u003E=2.3.0,\u003C2.4.0|\u003E=2.4.0,\u003C2.5.0|\u003E=2.5.0,\u003C2.6.0|\u003E=2.6.0,\u003C2.7.0|\u003E=2.7.0,\u003C2.7.48|\u003E=2.8.0,\u003C2.8.41|\u003E=3.0.0,\u003C3.1.0|\u003E=3.1.0,\u003C3.2.0|\u003E=3.2.0,\u003C3.3.0|\u003E=3.3.0,\u003C3.3.17|\u003E=3.4.0,\u003C3.4.11|\u003E=4.0.0,\u003C4.0.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2018-05-25 11:46:22","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-r2rq-3h56-fqm4"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2018-11386.yaml"}]},{"advisoryId":"PKSA-md26-zdw9-222r","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2015-2309.yaml","title":"Unsafe methods in the Request class","link":"https:\/\/symfony.com\/cve-2015-2309","cve":"CVE-2015-2309","affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.2.0|\u003E=2.2.0,\u003C2.3.0|\u003E=2.3.0,\u003C2.3.27|\u003E=2.4.0,\u003C2.5.0|\u003E=2.5.0,\u003C2.5.11|\u003E=2.6.0,\u003C2.6.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2015-04-01 18:55:26","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-p684-f7fh-jv2j"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2015-2309.yaml"}]},{"advisoryId":"PKSA-dr6c-z2rf-wh36","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2014-6061.yaml","title":"Security issue when parsing the Authorization header","link":"https:\/\/symfony.com\/cve-2014-6061","cve":"CVE-2014-6061","affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.2.0|\u003E=2.2.0,\u003C2.3.0|\u003E=2.3.0,\u003C2.3.19|\u003E=2.4.0,\u003C2.4.9|\u003E=2.5.0,\u003C2.5.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2014-09-03 07:38:23","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-h7v2-2qwg-h829"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2014-6061.yaml"}]},{"advisoryId":"PKSA-rhzp-d9k8-shyq","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2014-5244.yaml","title":"Denial of service with a malicious HTTP Host header","link":"https:\/\/symfony.com\/cve-2014-5244","cve":"CVE-2014-5244","affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.2.0|\u003E=2.2.0,\u003C2.3.0|\u003E=2.3.0,\u003C2.3.19|\u003E=2.4.0,\u003C2.4.9|\u003E=2.5.0,\u003C2.5.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2014-09-03 07:37:21","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-v77v-x634-9m56"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2014-5244.yaml"}]},{"advisoryId":"PKSA-tf6z-kynr-311v","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2013-4752.yaml","title":"Request::getHost() poisoning","link":"https:\/\/symfony.com\/blog\/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released","cve":"CVE-2013-4752","affectedVersions":"\u003E=2.0.0,\u003C2.0.24|\u003E=2.1.0,\u003C2.1.12|\u003E=2.2.0,\u003C2.2.5|\u003E=2.3.0,\u003C2.3.3","source":"FriendsOfPHP\/security-advisories","reportedAt":"2013-08-17 09:14:49","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-22pv-7v9j-hqxp"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2013-4752.yaml"}]},{"advisoryId":"PKSA-hd3k-4852-jhv2","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/2012-11-29.yaml","title":"Request::getClientIp() when the trust proxy mode is enabled","link":"https:\/\/symfony.com\/blog\/security-release-symfony-2-0-19-and-2-1-4","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C2.0.19|\u003E=2.1.0,\u003C2.1.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2012-11-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-vfm6-r2gc-pwww"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/2012-11-29.yaml"}]},{"advisoryId":"PKSA-msdq-r83n-tdy4","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2012-6431.yaml","title":"Routes behind a firewall are accessible even when not logged in","link":"https:\/\/symfony.com\/blog\/security-release-symfony-2-0-20-and-2-1-5-released","cve":"CVE-2012-6431","affectedVersions":"\u003E=2.0.0,\u003C2.0.19","source":"FriendsOfPHP\/security-advisories","reportedAt":"2012-03-19 15:59:52","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-83c3-qx27-2rwr"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2012-6431.yaml"}]}]}}