CVE-2026-118514

Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 5.4.0 through 5.4.55 symfony/http-foundation versions 6.0.0 through 6.4.49 symfony/http-foundation versions 7.0.0 through 7.4.22 symfony/http-foundation versions 8.0.0 through 8.1.10

Description SymfonyComponentHttpFoundationRequestMatcher and RequestMatcherMethodRequestMatcher (used from version 6.2.x onwards) perform verbatim comparisons when matching a request against a list of HTTP methods. Because HTTP semantics require the router to serve a HEAD request using the GET handler, security rules restricted to GET requests can be bypassed by sending a HEAD request to the same URL. This allows attackers to trigger controller execution and its side effects, as well as access response headers. This issue also impacts firewalls configured with methods: [GET], as a HEAD request may bypass the intended firewall and be handled by another or none at all. Applications utilizing these request matchers directly or via a custom request matcher are also affected.

Recommendations Update symfony/http-foundation to version 5.4.56 or later. Update symfony/http-foundation to version 6.4.50 or later. Update symfony/http-foundation to version 7.4.23 or later. Update symfony/http-foundation to version 8.1.11 or later.