Search for packages
| purl | pkg:composer/symfony/http-kernel@5.3.0-BETA4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-91hk-tdtv-x7fp
Aliases: CVE-2022-24894 GHSA-h7vf-5wrv-9fhv GMS-2023-209 GMS-2023-212 |
Duplicate This advisory duplicates another. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-gjcx-wmhp-fqef
Aliases: CVE-2021-41267 GHSA-q3j3-w37x-hq2q |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') `Symfony/Http-Kernel` is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the `trusted_headers` allowed list are ignored and protect users from Cache poisoning attacks. In Symfony, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the `trusted_headers` allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T03:26:23.454590+00:00 | GitLab Importer | Affected by | VCID-91hk-tdtv-x7fp | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/http-kernel/GMS-2023-209.yml | 38.6.0 |
| 2026-06-06T01:10:59.468615+00:00 | GitLab Importer | Affected by | VCID-gjcx-wmhp-fqef | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/http-kernel/CVE-2021-41267.yml | 38.6.0 |