VulnerableCode Package Details - pkg:composer/symfony/http-foundation@2.0.22

Search for packages

Advisory	Summary	Fixed in package version
GHSA-3rg7-wf37-54rm Aliases: CVE-2025-64500	Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass ### Description The `Request` class improperly interprets some `PATH_INFO` …	5.4.50 Vulnerable
GHSA-22pv-7v9j-hqxp Aliases: CVE-2013-4752	Symfony Host Header Injection vulnerability in the HttpFoundation component Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and …	2.0.24 Vulnerable
GHSA-xhh6-956q-4q69 Aliases: CVE-2019-18888	Argument injection in a MimeTypeGuesser in Symfony An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 …	2.8.52 Vulnerable
GHSA-mrqx-rp3w-jpjp Aliases: CVE-2024-50345	Symfony vulnerable to open redirect via browser-sanitized URLs ### Description The `Request` class, does not parse URI with special characters …	5.4.46 Vulnerable
GHSA-p684-f7fh-jv2j Aliases: CVE-2015-2309	Symfony has unsafe methods in the Request class All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the …	2.3.27 Vulnerable
GHSA-h7v2-2qwg-h829 Aliases: CVE-2014-6061	Symfony has a security issue when parsing the Authorization header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of …	2.3.19 Vulnerable
GHSA-v77v-x634-9m56 Aliases: CVE-2014-5244	Symfony vulnerable to denial of service via a malicious HTTP Host header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X …	2.3.19 Vulnerable
CVE-2018-11386	Insufficient Session Expiration The `PDOSessionHandler` class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2014-5244	Uncontrolled Resource Consumption Denial of service with a malicious HTTP Host header.	2.4.9 Vulnerable 2.5.4 Vulnerable
CVE-2018-14773	URL Rewrite vulnerability An issue in Symfony arises from support for a (legacy) IIS header that lets users override the …	2.8.44 Vulnerable 3.4.14 Vulnerable 4.0.14 Vulnerable 4.1.3 Vulnerable
CVE-2015-2309	Unsafe methods in the Request class The `Symfony\Component\HttpFoundation\Request` class provides a mechanism that ensures it does not trust HTTP header …	2.5.11 Vulnerable 2.6.6 Vulnerable 2.3.27 Vulnerable
CVE-2014-6061	Improper Authorization Security issue when parsing the Authorization header.	2.4.9 Vulnerable 2.5.4 Vulnerable

Advisory

Summary

Fixed in package version

GHSA-3rg7-wf37-54rm
Aliases:
CVE-2025-64500

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass ### Description The `Request` class improperly interprets some `PATH_INFO` …

5.4.50
Vulnerable

GHSA-22pv-7v9j-hqxp
Aliases:
CVE-2013-4752

Symfony Host Header Injection vulnerability in the HttpFoundation component Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and …

2.0.24
Vulnerable

GHSA-xhh6-956q-4q69
Aliases:
CVE-2019-18888

Argument injection in a MimeTypeGuesser in Symfony An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 …

2.8.52
Vulnerable

GHSA-mrqx-rp3w-jpjp
Aliases:
CVE-2024-50345

Symfony vulnerable to open redirect via browser-sanitized URLs ### Description The `Request` class, does not parse URI with special characters …

5.4.46
Vulnerable

GHSA-p684-f7fh-jv2j
Aliases:
CVE-2015-2309

Symfony has unsafe methods in the Request class All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the …

2.3.27
Vulnerable

GHSA-h7v2-2qwg-h829
Aliases:
CVE-2014-6061

Symfony has a security issue when parsing the Authorization header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of …

2.3.19
Vulnerable

GHSA-v77v-x634-9m56
Aliases:
CVE-2014-5244

Symfony vulnerable to denial of service via a malicious HTTP Host header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X …

2.3.19
Vulnerable

CVE-2018-11386

Insufficient Session Expiration The `PDOSessionHandler` class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted …

2.8.41
Vulnerable

3.4.11
Vulnerable

4.0.11
Vulnerable

CVE-2014-5244

Uncontrolled Resource Consumption Denial of service with a malicious HTTP Host header.

2.4.9
Vulnerable

2.5.4
Vulnerable

CVE-2018-14773

URL Rewrite vulnerability An issue in Symfony arises from support for a (legacy) IIS header that lets users override the …

2.8.44
Vulnerable

3.4.14
Vulnerable

4.0.14
Vulnerable

4.1.3
Vulnerable

CVE-2015-2309

Unsafe methods in the Request class The `Symfony\Component\HttpFoundation\Request` class provides a mechanism that ensures it does not trust HTTP header …

2.5.11
Vulnerable

2.6.6
Vulnerable

2.3.27
Vulnerable

CVE-2014-6061

Improper Authorization Security issue when parsing the Authorization header.

2.4.9
Vulnerable

2.5.4
Vulnerable

Next non-vulnerable version	5.4.54
Latest non-vulnerable version	8.1.7
Risk score	3.4