CVE-2019-18887
Symfony Http-Kernel has non-constant time comparison in UriSigner
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
- Record
CVE-2019-18887- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
- Record
CVE-2019-18887- Updated
- 2026-11-02
EUVDEUVD-2022-1515 No score
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
- Record
EUVD-2022-1515- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q8hg-pf8v-cxrv
Symfony Http-Kernel has non-constant time comparison in UriSigner
When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.
- Record
GHSA-q8hg-pf8v-cxrv- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-203
- Updated
- 2026-11-02
OSV
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
- Record
CVE-2019-18887- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-18887
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
- Record
DEBIAN-CVE-2019-18887- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-q8hg-pf8v-cxrv
Symfony Http-Kernel has non-constant time comparison in UriSigner
When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.
- Record
GHSA-q8hg-pf8v-cxrv- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-203
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-18887
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
- Record
UBUNTU-CVE-2019-18887- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/http-kernelPackagist |
2.2.0 up to 2.8.52 | 2.8.52 |
symfony/http-kernelPackagist |
3.0.0 up to 3.4.35 | 3.4.35 |
symfony/http-kernelPackagist |
4.0.0 up to 4.2.12 | 4.2.12 |
symfony/http-kernelPackagist |
4.3.0 up to 4.3.8 | 4.3.8 |
symfony/symfonyPackagist |
2.2.0 up to 2.8.52 | 2.8.52 |
symfony/symfonyPackagist |
3.0.0 up to 3.4.35 | 3.4.35 |
symfony/symfonyPackagist |
4.0.0 up to 4.2.12 | 4.2.12 |
symfony/symfonyPackagist |
4.3.0 up to 4.3.8 | 4.3.8 |
symfonyDebian:12 |
before 4.3.8+dfsg-1 | 4.3.8+dfsg-1 |
symfonyDebian:13 |
before 4.3.8+dfsg-1 | 4.3.8+dfsg-1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfonyDebian:14 |
before 4.3.8+dfsg-1 | 4.3.8+dfsg-1 |
symfonyDebian:8 From an advisory covering 3 CVEs |
before 2.3.21+dfsg-4+deb8u6, plus listed versions 2.3.21+dfsg-42.3.21+dfsg-4+deb8u12.3.21+dfsg-4+deb8u22.3.21+dfsg-4+deb8u32.3.21+dfsg-4+deb8u42.3.21+dfsg-4+deb8u5 |
2.3.21+dfsg-4+deb8u6 |
symfonyDebian:9 From an advisory covering 2 CVEs |
before 2.8.7+dfsg-1.3+deb9u3, plus listed versions 2.8.7+dfsg-1.32.8.7+dfsg-1.3+deb9u12.8.7+dfsg-1.3+deb9u2 |
2.8.7+dfsg-1.3+deb9u3 |
symfonyDebian:10 From an advisory covering 2 CVEs |
before 3.4.22+dfsg-2+deb10u1, plus listed versions 3.4.22+dfsg-2 |
3.4.22+dfsg-2+deb10u1 |
symfony/http-kernelPackagist |
2.2.0 up to 2.8.52, plus listed versions v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2 Show 45 moreShow lessv2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.37v2.3.38v2.3.39v2.3.4v2.3.40v2.3.41v2.3.42 |
2.8.52 |
symfony/http-kernelPackagist |
3.0.0 up to 3.4.35, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.35 |
symfony/http-kernelPackagist |
4.0.0 up to 4.2.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 43 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9 |
4.2.12 |
symfony/http-kernelPackagist |
4.3.0 up to 4.3.8, plus listed versions v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7 |
4.3.8 |
symfony/symfonyPackagist |
2.2.0 up to 2.8.52, plus listed versions v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2 Show 45 moreShow lessv2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.0-BETA1v2.3.0-BETA2v2.3.0-RC1v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.35v2.3.36v2.3.37v2.3.38v2.3.39v2.3.4 |
2.8.52 |
symfony/symfonyPackagist |
3.0.0 up to 3.4.35, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.35 |
symfony/symfonyPackagist |
4.0.0 up to 4.2.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 43 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9 |
4.2.12 |
symfony/symfonyPackagist |
4.3.0 up to 4.3.8, plus listed versions v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7 |
4.3.8 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-18887 is a high vulnerability (CVSS 8.1) in Sensiolabs Symfony, published November 18, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in symfony/http-kernel 2.8.52.
References
symfony.com/blog/symfony-4-3-8-released
github.com/symfony/symfony/releases/tag/v4.3.8
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-18887
security-tracker.debian.org/tracker/CVE-2019-18887
ubuntu.com/security/CVE-2019-18887
cve.org/CVERecord?id=CVE-2019-18887
Left out here: 427 versions. The JSON record has them.