`SymfonyComponentHttpFoundationRequestMatcher` and `RequestMatcherMethodRequestMatcher` (used from version 6.2.x onwards) perform verbatim comparisons when matching a request against a list of HTTP methods. Because HTTP semantics require the router to serve a HEAD request using the GET handler, security rules restricted to GET requests can be bypassed by sending a HEAD request to the same URL. This allows attackers to trigger controller execution and its side effects, as well as access response headers. This issue also impacts firewalls configured with `methods: [GET]`, as a HEAD request may bypass the intended firewall and be handled by another or none at all. Applications utilizing these request matchers directly or via a custom `request matcher` are also affected.