{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118514", "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "state": "PUBLISHED", "assignerShortName": "Checkmarx", "dateReserved": "2026-10-28T14:33:36.992Z", "datePublished": "2026-11-06T14:09:56.213Z", "dateUpdated": "2026-11-06T14:09:56.213Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "shortName": "Checkmarx", "dateUpdated": "2026-11-06T14:09:56.213Z"}, "title": "Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863", "type": "CWE"}]}], "affected": [{"vendor": "symfony", "product": "symfony", "collectionURL": "https://packagist.org/packages/symfony/http-foundation", "packageName": "symfony/http-foundation", "repo": "https://github.com/symfony/http-foundation", "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.56", "versionType": "git"}, {"status": "affected", "version": "6", "lessThan": "6.4.50", "versionType": "git"}, {"status": "affected", "version": "7", "lessThan": "7.4.23", "versionType": "git"}, {"status": "affected", "version": "8", "lessThan": "8.1.11", "versionType": "git"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11,\u00a0Symfony\\Component\\HttpFoundation\\RequestMatcher,\u00a0and\u00a0RequestMatcher\\MethodRequestMatcher\u00a0which replaces it from 6.2.x on, matches a request against a list of HTTP methods.\u00a0These compared the request method to the list verbatim, while the router serves a\u00a0HEAD\u00a0request with the\u00a0GET\u00a0handler, as HTTP semantics require.\n\nThis came after the incomplete fix of\u00a0 CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which\u00a0addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only.\n\n\n\nSecurity rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects.\n\n\n\nThis issue also affects firewalls configured with methods: [GET]. A\u00a0HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected.\n\n\n\nThe issue affects\u00a0symfony/http-foundation\u00a0through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11,&nbsp;<code>Symfony\\Component\\HttpFoundation\\RequestMatcher,</code>&nbsp;and&nbsp;<code>RequestMatcher\\MethodRequestMatcher</code>&nbsp;which replaces it from 6.2.x on, matches a request against a list of HTTP methods.&nbsp;These compared the request method to the list verbatim, while the router serves a&nbsp;<code>HEAD</code>&nbsp;request with the&nbsp;<code>GET</code>&nbsp;handler, as HTTP semantics require.<br><br>This came after the incomplete fix of&nbsp;<a title=\"CVE-2026-45075\" href=\"https://github.com/advisories/GHSA-6439-2f28-8p8q\" rel=\"noreferrer\">CVE-2026-45075</a>, which&nbsp;addressed the same gap in the <code>#[IsGranted]</code>, <code>#[IsSignatureValid]</code> and <code>#[IsCsrfTokenValid]</code> attributes only.<br><br><p>Security rules configured to apply only to <code>GET</code> requests could therefore be bypassed by sending a <code>HEAD</code> request to the same URL. Although <code>HEAD</code> responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects.</p><p>This issue also affects firewalls configured with <code>methods: [GET]</code>. A&nbsp;<code>HEAD</code> request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall <code>request_matcher</code>, could also be affected.</p></div><div>The issue affects&nbsp;<code>symfony/http-foundation</code>&nbsp;through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.</div>"}]}], "references": [{"url": "https://github.com/symfony/symfony/security/advisories/GHSA-jrf8-gvm4-7cgh", "tags": ["vendor-advisory"]}, {"url": "https://github.com/symfony/symfony/commit/cd20e9f8f16d1f0df6c2eac19bdb649325a192bd", "tags": ["patch"]}, {"url": "https://github.com/symfony/symfony/commit/13a8b85be687499cbc69a534ada16683f9ba3889", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Ivan Tse", "type": "reporter"}, {"lang": "en", "value": "Nicolas Grekas", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org/packages/symfony/http-foundation", "defaultStatus": "unaffected", "packageName": "symfony/http-foundation", "product": "symfony", "repo": "https://github.com/symfony/http-foundation", "vendor": "symfony", "versions": [{"lessThan": "5.4.56", "status": "affected", "version": "0", "versionType": "git"}, {"lessThan": "6.4.50", "status": "affected", "version": "6", "versionType": "git"}, {"lessThan": "7.4.23", "status": "affected", "version": "7", "versionType": "git"}, {"lessThan": "8.1.11", "status": "affected", "version": "8", "versionType": "git"}]}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11,\u00a0Symfony\\Component\\HttpFoundation\\RequestMatcher,\u00a0and\u00a0RequestMatcher\\MethodRequestMatcher\u00a0which replaces it from 6.2.x on, matches a request against a list of HTTP methods.\u00a0These compared the request method to the list verbatim, while the router serves a\u00a0HEAD\u00a0request with the\u00a0GET\u00a0handler, as HTTP semantics require.\n\nThis came after the incomplete fix of\u00a0 CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which\u00a0addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only.\n\n\n\nSecurity rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects.\n\n\n\nThis issue also affects firewalls configured with methods: [GET]. A\u00a0HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected.\n\n\n\nThe issue affects\u00a0symfony/http-foundation\u00a0through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10."}], "id": "CVE-2026-118514", "lastModified": "2026-11-06T15:17:11.907", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}]}, "published": "2026-11-06T15:17:11.907", "references": [{"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/commit/13a8b85be687499cbc69a534ada16683f9ba3889"}, {"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/commit/cd20e9f8f16d1f0df6c2eac19bdb649325a192bd"}, {"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/security/advisories/GHSA-jrf8-gvm4-7cgh"}], "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.4.56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6,6.4.50)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7,7.4.23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8,8.1.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "symfony", "source": "cna", "vendor": "symfony"}, "product": "symfony", "vendor": "symfony"}], "created": "2026-11-06T15:45:04.650146+00:00", "updated": "2026-11-06T15:45:05.025247+00:00", "vendors": ["symfony", "symfony$PRODUCT$symfony"]}