CVE-2019-10913
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
- Record
CVE-2019-10913- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-79, CWE-89
- Updated
- 2026-11-02
CVE List No score
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
- Record
CVE-2019-10913- Updated
- 2026-11-02
EUVDEUVD-2019-0806 No score
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
- Record
EUVD-2019-0806- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x92h-wmg2-6hp7
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
- Record
GHSA-x92h-wmg2-6hp7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-79, CWE-89
- Updated
- 2026-11-02
OSV
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
- Record
CVE-2019-10913- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-10913
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
- Record
DEBIAN-CVE-2019-10913- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-x92h-wmg2-6hp7
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
- Record
GHSA-x92h-wmg2-6hp7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-79, CWE-89
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10913
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
- Record
UBUNTU-CVE-2019-10913- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/http-foundationPackagist |
2.7.0 up to 2.7.51 | 2.7.51 |
symfony/http-foundationPackagist |
2.8.0 up to 2.8.50 | 2.8.50 |
symfony/http-foundationPackagist |
3.0.0 up to 3.4.26 | 3.4.26 |
symfony/http-foundationPackagist |
4.0.0 up to 4.1.12 | 4.1.12 |
symfony/http-foundationPackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.51 | 2.7.51 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.50 | 2.8.50 |
symfony/symfonyPackagist |
3.0.0 up to 3.4.26 | 3.4.26 |
symfony/symfonyPackagist |
4.0.0 up to 4.1.12 | 4.1.12 |
symfony/symfonyPackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfonyDebian:12 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:13 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:14 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:8 From an advisory covering 4 CVEs |
before 2.3.21+dfsg-4+deb8u5, plus listed versions 2.3.21+dfsg-42.3.21+dfsg-4+deb8u12.3.21+dfsg-4+deb8u22.3.21+dfsg-4+deb8u32.3.21+dfsg-4+deb8u4 |
2.3.21+dfsg-4+deb8u5 |
symfonyDebian:9 From an advisory covering 8 CVEs |
before 2.8.7+dfsg-1.3+deb9u2, plus listed versions 2.8.7+dfsg-1.32.8.7+dfsg-1.3+deb9u1 |
2.8.7+dfsg-1.3+deb9u2 |
symfony/http-foundationPackagist |
2.7.0 up to 2.7.51, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 45 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8 |
2.7.51 |
symfony/http-foundationPackagist |
2.8.0 up to 2.8.50, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.50 |
symfony/http-foundationPackagist |
3.0.0 up to 3.4.26, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.26 |
symfony/http-foundationPackagist |
4.0.0 up to 4.1.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 26 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9 |
4.1.12 |
symfony/http-foundationPackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.51, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 45 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8 |
2.7.51 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.50, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.50 |
symfony/symfonyPackagist |
3.0.0 up to 3.4.26, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.26 |
symfony/symfonyPackagist |
4.0.0 up to 4.1.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 26 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9 |
4.1.12 |
symfony/symfonyPackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10913 is a critical vulnerability (CVSS 9.8) in Sensiolabs Symfony, published May 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.87%, the 79th percentile. Fixed in symfony/http-foundation 2.7.51.
References
symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
nvd.nist.gov/vuln/detail/CVE-2019-10913
Left out here: 90 versions. The JSON record has them.