CVE-2026-118514 · Package
NO FIX YET · SEE WHAT TO DO
Symfony's request matcher compares HTTP methods verbatim, so a HEAD request to a GET-only route is not matched by GET rules while the router still runs the GET controller. An attacker can bypass GET-only security rules and trigger controller side effects, reading response headers.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications built on Symfony that rely on GET-only firewall rules or on RequestMatcher/MethodRequestMatcher, including custom firewall request matchers, are exposed because HEAD requests slip past the method check. Applications with no method-restricted firewalls or security rules, or that already run a fixed version, are not affected by this bypass.
Not affected if fixed-version, no-custom-request-matcher, no-get-only-rules
Who cares php, symfony, web-apps
symfony/http-foundation in composer.lock and check the installed version with composer show symfony/http-foundationmethods: [GET] in firewall or access_control config and for custom request_matcher entries using RequestMatcher or MethodRequestMatchersymfony/http-foundation 5.4.56In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the list verbatim, while the router serves a HEAD request with the GET handler, as HTTP semantics require.
This came after the incomplete fix of CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only.
Security rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects.
This issue also affects firewalls configured with methods: [GET]. A HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected.
The issue affects symfony/http-foundation through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
symfony/http-foundation 6.4.50symfony/http-foundation 7.4.23symfony/http-foundation 8.1.11This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.