Every CVE Search/ Get API key

CVE-2020-5255

Prevent cache poisoning via a Response Content-Type header

2.6 LowFix available

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.30%Up 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 2.6

Prevent cache poisoning via a Response Content-Type header

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Record
CVE-2020-5255
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-435
Updated
2026-11-02
EUVDEUVD-2020-0351 2.6

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Record
EUVD-2020-0351
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-mcx4-f5f5-4859 2.6

Prevent cache poisoning via a Response Content-Type header in Symfony

Description

When a Response does not contain a Content-Type header, Symfony falls back to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can lead to a corrupted cache where the cached format is not the right one.

Resolution

Symfony does not use the Accept header anymore to guess the Content-Type.

The patch for this issue is available here for the 4.4 branch.

Credits

I would like to thank Xavier Lacot from JoliCode for reporting & Yonel Ceruto and Tobias Schultze for fixing the issue.

Record
GHSA-mcx4-f5f5-4859
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-435
Updated
2026-11-02
NVD 2.6

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Record
CVE-2020-5255
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-435, CWE-20
Updated
2026-11-02
OSV 4.3

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Record
CVE-2020-5255
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2020-5255 4.3

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Record
DEBIAN-CVE-2020-5255
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVGHSA-mcx4-f5f5-4859 2.6

Prevent cache poisoning via a Response Content-Type header in Symfony

Description

When a Response does not contain a Content-Type header, Symfony falls back to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can lead to a corrupted cache where the cached format is not the right one.

Resolution

Symfony does not use the Accept header anymore to guess the Content-Type.

The patch for this issue is available here for the 4.4 branch.

Credits

I would like to thank Xavier Lacot from JoliCode for reporting & Yonel Ceruto and Tobias Schultze for fixing the issue.

Record
GHSA-mcx4-f5f5-4859
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-435
Updated
2026-11-02
OSVBIT-symfony-2020-5255 No score

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Record
BIT-symfony-2020-5255
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/http-foundation
Packagist
 4.4.0 up to 4.4.7
4.4.7
symfony/http-foundation
Packagist
 5.0.0 up to 5.0.7
5.0.7
symfony/symfony
Packagist
 4.4.0 up to 4.4.7
4.4.7
symfony/symfony
Packagist
 5.0.0 up to 5.0.7
5.0.7
symfony
Bitnami
 4.4.0 up to 4.4.7, 5.0.0 up to 5.0.7
4.4.75.0.7
symfony
Debian:12
 before 4.4.8-1
4.4.8-1
symfony
Debian:13
 before 4.4.8-1
4.4.8-1
symfony
Debian:14
 before 4.4.8-1
4.4.8-1
symfony/http-foundation
Packagist
 4.4.0 up to 4.4.7, plus listed versions
v4.4.0v4.4.1v4.4.2v4.4.3v4.4.4v4.4.5v4.4.6
4.4.7
symfony/http-foundation
Packagist
 5.0.0 up to 5.0.7, plus listed versions
v5.0.0v5.0.1v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6
5.0.7
symfony/symfony
Packagist
 4.4.0 up to 4.4.7, plus listed versions
v4.4.0v4.4.1v4.4.2v4.4.3v4.4.4v4.4.5v4.4.6
4.4.7
symfony/symfony
Packagist
 5.0.0 up to 5.0.7, plus listed versions
v5.0.0v5.0.1v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6
5.0.7

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-5255 is a low vulnerability (CVSS 2.6) in Sensiolabs Symfony, published March 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.30%, the 70th percentile. Fixed in symfony/http-foundation 4.4.7.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open