CVE-2026-123339

Name of the Vulnerable Software and Affected Versions Symfony HttpKernel versions prior to 5.4.56 Symfony HttpKernel versions prior to 6.4.50 Symfony HttpKernel versions prior to 7.4.23 Symfony HttpKernel versions prior to 8.1.11

Description Improper trust of forwarded headers in the onKernelFinishRequest() function of RouterListener allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the remainder of a request. This occurs when a page renders an inline fragment via render() in Twig or an inline ESI tag; the SubRequestHandler temporarily adds 127.0.0.1 to trusted proxies, causing RouterListener to trust X-Forwarded-* and Forwarded headers from requests with a client address of 127.0.0.1, even if not explicitly configured. Consequently, absolute URLs produced by url() in Twig and UrlGeneratorInterface::ABSOLUTE URL can be manipulated, potentially poisoning links in shared caches or emails. This issue affects applications reached over HTTP from 127.0.0.1, such as those behind a TLS terminator, reverse proxy, local HTTP cache, or sidecar proxy on the same host that forwards client headers. If framework.trusted hosts is configured, hosts outside the list are rejected, but the scheme and port remain mutable.

Recommendations Update Symfony HttpKernel to version 5.4.56 or later. Update Symfony HttpKernel to version 6.4.50 or later. Update Symfony HttpKernel to version 7.4.23 or later. Update Symfony HttpKernel to version 8.1.11 or later.