Symfony http-foundation up to 5.4.55/6.4.49/7.4.22/8.1.10 Request Matcher Symfony\Component\HttpFoundation\RequestMatcher access control

Summaryinfo

A vulnerability was found in Symfony http-foundation up to 5.4.55/6.4.49/7.4.22/8.1.10 and classified as critical. The affected element is the function Symfony\Component\HttpFoundation\RequestMatcher of the component Request Matcher. Executing a manipulation can lead to access control. This vulnerability is tracked as CVE-2026-118514. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Symfony http-foundation up to 5.4.55/6.4.49/7.4.22/8.1.10 and classified as critical. This vulnerability affects the function Symfony\Component\HttpFoundation\RequestMatcher of the component Request Matcher. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the list verbatim, while the router serves a HEAD request with the GET handler, as HTTP semantics require. This came after the incomplete fix of  CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only. Security rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects. This issue also affects firewalls configured with methods: [GET]. A HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected. The issue affects symfony/http-foundation through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-118514 since 10/28/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 5.4.56, 6.4.50, 7.4.23 or 8.1.11 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Symfony

Name

• http-foundation

Version

• 5.4.0
• 5.4.1
• 5.4.2
• 5.4.3
• 5.4.4
• 5.4.5
• 5.4.6
• 5.4.7
• 5.4.8
• 5.4.9
• 5.4.10
• 5.4.11
• 5.4.12
• 5.4.13
• 5.4.14
• 5.4.15
• 5.4.16
• 5.4.17
• 5.4.18
• 5.4.19
• 5.4.20
• 5.4.21
• 5.4.22
• 5.4.23
• 5.4.24
• 5.4.25
• 5.4.26
• 5.4.27
• 5.4.28
• 5.4.29
• 5.4.30
• 5.4.31
• 5.4.32
• 5.4.33
• 5.4.34
• 5.4.35
• 5.4.36
• 5.4.37
• 5.4.38
• 5.4.39
• 5.4.40
• 5.4.41
• 5.4.42
• 5.4.43
• 5.4.44
• 5.4.45
• 5.4.46
• 5.4.47
• 5.4.48
• 5.4.49
• 5.4.50
• 5.4.51
• 5.4.52
• 5.4.53
• 5.4.54
• 5.4.55
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 6.4.9
• 6.4.10
• 6.4.11
• 6.4.12
• 6.4.13
• 6.4.14
• 6.4.15
• 6.4.16
• 6.4.17
• 6.4.18
• 6.4.19
• 6.4.20
• 6.4.21
• 6.4.22
• 6.4.23
• 6.4.24
• 6.4.25
• 6.4.26
• 6.4.27
• 6.4.28
• 6.4.29
• 6.4.30
• 6.4.31
• 6.4.32
• 6.4.33
• 6.4.34
• 6.4.35
• 6.4.36
• 6.4.37
• 6.4.38
• 6.4.39
• 6.4.40
• 6.4.41
• 6.4.42
• 6.4.43
• 6.4.44
• 6.4.45
• 6.4.46
• 6.4.47
• 6.4.48
• 6.4.49
• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3
• 7.4.4
• 7.4.5
• 7.4.6
• 7.4.7
• 7.4.8
• 7.4.9
• 7.4.10
• 7.4.11
• 7.4.12
• 7.4.13
• 7.4.14
• 7.4.15
• 7.4.16
• 7.4.17
• 7.4.18
• 7.4.19
• 7.4.20
• 7.4.21
• 7.4.22
• 8.1.0
• 8.1.1
• 8.1.2
• 8.1.3
• 8.1.4
• 8.1.5
• 8.1.6
• 8.1.7
• 8.1.8
• 8.1.9
• 8.1.10

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion