Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/symfony/http-foundation@6.4.7
purl pkg:composer/symfony/http-foundation@6.4.7
Next non-vulnerable version 6.4.46
Latest non-vulnerable version 8.1.7
Risk score 3.9
Vulnerabilities affecting this package (4)
Advisory Summary Fixed in package version
GHSA-3rg7-wf37-54rm
Aliases:
CVE-2025-64500
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass ### Description The `Request` class improperly interprets some `PATH_INFO` …
6.4.29
Vulnerable
GHSA-mrqx-rp3w-jpjp
Aliases:
CVE-2024-50345
Symfony vulnerable to open redirect via browser-sanitized URLs ### Description The `Request` class, does not parse URI with special characters …
6.4.14
Vulnerable
GHSA-38cx-cq6f-5755
Aliases:
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient ### Description `Symfony\Component\HttpClient\NoPrivateNetworkHttpClient` is documented as …
6.4.41
Vulnerable
GHSA-r925-mgvr-h9cc
Aliases:
CVE-2026-108082
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header ### Description `HeaderUtils::split()` parsed header values with a pattern whose …
6.4.46
Not vulnerable
This package is not known to fix any advisories.