CVE-2024-50345
Open redirect via browser-sanitized URLs in symfony/http-foundation
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Open redirect via browser-sanitized URLs in symfony/http-foundation
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-50345- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2024-3285
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-3285- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mrqx-rp3w-jpjp
Symfony vulnerable to open redirect via browser-sanitized URLs
Description
The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.
Resolution
The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
- Record
GHSA-mrqx-rp3w-jpjp- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-50345- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Open redirect via browser-sanitized URLs in symfony/http-foundation
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-50345- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-50345
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
DEBIAN-CVE-2024-50345- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-mrqx-rp3w-jpjp
Symfony vulnerable to open redirect via browser-sanitized URLs
Description
The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.
Resolution
The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
- Record
GHSA-mrqx-rp3w-jpjp- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-50345
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
UBUNTU-CVE-2024-50345- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1774399515 No score
TuxCare security update for symfony/http-foundation (1 CVE)
TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 4.4.49-p2+tuxcare.
- Record
CLSA-2026-1774399515- Updated
- 2026-11-02
OSVCLSA-2026-1778978781 No score
TuxCare security update for symfony/http-foundation (2 CVEs)
TuxCare rebuilt symfony/http-foundation to address 2 CVEs. Fixed in 3.4.47-p3+tuxcare.
- Record
CLSA-2026-1778978781- Updated
- 2026-11-02
OSVCLSA-2026-1778978921 No score
TuxCare security update for symfony/http-foundation (2 CVEs)
TuxCare rebuilt symfony/http-foundation to address 2 CVEs. Fixed in 3.4.47-p3+tuxcare.
- Record
CLSA-2026-1778978921- Updated
- 2026-11-02
OSVCLSA-2026-1790173339 No score
TuxCare security update for symfony/http-foundation (1 CVE)
TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 2.8.52-p2+tuxcare.
- Record
CLSA-2026-1790173339- Updated
- 2026-11-02
OSVUSN-7272-1 No score
symfony vulnerabilities
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in the web cache. An attacker could possibly use this issue to obtain sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of user session information. An attacker could possibly use this issue to perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An attacker could possibly use this issue to perform cross site scripting. (CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special input with a PHP directive in URL query strings. An attacker could possibly use this issue to expose sensitive information or cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50340)
Oleg Andreyev, Antoine Makdessi, and Moritz Rauch discovered that Symfony incorrectly handled user authentication. An attacker could possibly use this issue to access unauthorized resources and expose sensitive information. This issue was only addressed in Ubuntu 24.04 LTS. (CVE-2024-50341, CVE-2024-51996)
Linus Karlsson and Chris Smith discovered that Symfony returned internal host information during host resolution. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50342)
It was discovered that Symfony incorrectly parsed user input through regular expressions. An attacker could possibly use this issue to expose sensitive information. (CVE-2024-50343)
Sam Mush discovered that Symfony incorrectly parsed URIs with special characters. An attacker could possibly use this issue to perform phishing attacks. (CVE-2024-50345)
- Record
USN-7272-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/http-foundationPackagist |
before 5.4.46 | 5.4.46 |
symfony/http-foundationPackagist |
6.0.0 up to 6.4.14 | 6.4.14 |
symfony/http-foundationPackagist |
7.0.0 up to 7.1.7 | 7.1.7 |
symfony/http-foundationTuxCare:Packagist |
v4.4.49 up to 4.4.49-p2+tuxcare, plus listed versions 4.4.49-p1+tuxcare |
4.4.49-p2+tuxcare |
symfony/http-foundationTuxCare:Packagist From an advisory covering 2 CVEs |
v3.4.47 up to 3.4.47-p3+tuxcare | 3.4.47-p3+tuxcare |
symfony/http-foundationTuxCare:Packagist |
v2.8.52 up to 2.8.52-p2+tuxcare, plus listed versions 2.8.52-p1+tuxcare |
2.8.52-p2+tuxcare |
symfonyDebian:12 |
before 5.4.23+dfsg-1+deb12u3, plus listed versions 5.4.23+dfsg-15.4.23+dfsg-1+deb12u15.4.23+dfsg-1+deb12u2 |
5.4.23+dfsg-1+deb12u3 |
symfonyDebian:13 |
before 6.4.14+dfsg-1 | 6.4.14+dfsg-1 |
symfonyDebian:14 |
before 6.4.14+dfsg-1 | 6.4.14+dfsg-1 |
symfonyDebian:11 From an advisory covering 2 CVEs |
before 4.4.19+dfsg-2+deb11u7, plus listed versions 4.4.19+dfsg-24.4.19+dfsg-2+deb11u14.4.19+dfsg-2+deb11u24.4.19+dfsg-2+deb11u34.4.19+dfsg-2+deb11u44.4.19+dfsg-2+deb11u54.4.19+dfsg-2+deb11u6 |
4.4.19+dfsg-2+deb11u7 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfonyDebian:12 From an advisory covering 4 CVEs |
before 5.4.23+dfsg-1+deb12u3, plus listed versions 5.4.23+dfsg-15.4.23+dfsg-1+deb12u15.4.23+dfsg-1+deb12u2 |
5.4.23+dfsg-1+deb12u3 |
symfony/http-foundationPackagist |
before 5.4.46, plus listed versions 2.0.42.0.52.0.62.0.7v2.0.10 Show 45 moreShow lessv2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11 |
5.4.46 |
symfony/http-foundationPackagist |
6.0.0 up to 6.4.14, plus listed versions v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12 Show 45 moreShow lessv6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.19v6.0.2v6.0.20v6.0.3v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.5v6.2.6v6.2.7v6.2.8v6.3.0v6.3.0-BETA1 |
6.4.14 |
symfony/http-foundationPackagist |
7.0.0 up to 7.1.7, plus listed versions v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6 Show 9 moreShow lessv7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.3v7.1.5v7.1.6 |
7.1.7 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
symfonyUbuntu:Pro:20.04:LTS |
before 4.3.8+dfsg-1ubuntu1+esm2, plus listed versions 4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1+esm1 |
4.3.8+dfsg-1ubuntu1+esm2 |
symfonyUbuntu:Pro:22.04:LTS |
before 5.4.4+dfsg-1ubuntu8+esm1, plus listed versions 5.2.6+dfsg-1ubuntu75.4.4+dfsg-1ubuntu8 |
5.4.4+dfsg-1ubuntu8+esm1 |
symfonyUbuntu:Pro:24.04:LTS |
before 6.4.5+dfsg-3ubuntu3+esm1, plus listed versions 5.4.23+dfsg-1ubuntu15.4.35+dfsg-3ubuntu16.4.5+dfsg-3ubuntu26.4.5+dfsg-3ubuntu3 |
6.4.5+dfsg-3ubuntu3+esm1 |
symfonyUbuntu:25.10 |
All versions, plus listed versions 6.4.18+dfsg-1ubuntu16.4.21+dfsg-26.4.21+dfsg-2ubuntu16.4.24+dfsg-1 |
None known |
symfonyUbuntu:26.04:LTS |
All versions, plus listed versions 6.4.24+dfsg-17.4.5+dfsg-1ubuntu17.4.6+dfsg-2ubuntu17.4.7+dfsg-1ubuntu1 |
None known |
symfonyUbuntu:Pro:20.04:LTS From an advisory covering 9 CVEs |
before 4.3.8+dfsg-1ubuntu1+esm2, plus listed versions 4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1+esm1 |
4.3.8+dfsg-1ubuntu1+esm2 |
symfonyUbuntu:Pro:22.04:LTS From an advisory covering 9 CVEs |
before 5.4.4+dfsg-1ubuntu8+esm1, plus listed versions 5.2.6+dfsg-1ubuntu75.4.4+dfsg-1ubuntu8 |
5.4.4+dfsg-1ubuntu8+esm1 |
symfonyUbuntu:Pro:24.04:LTS From an advisory covering 9 CVEs |
before 6.4.5+dfsg-3ubuntu3+esm1, plus listed versions 5.4.23+dfsg-1ubuntu15.4.35+dfsg-3ubuntu16.4.5+dfsg-3ubuntu26.4.5+dfsg-3ubuntu3 |
6.4.5+dfsg-3ubuntu3+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-50345 is a low vulnerability (CVSS 3.1) in Sensiolabs Symfony, published November 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in symfony/http-foundation 5.4.46.
References
github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp
url.spec.whatwg.org
lists.debian.org/debian-lts-announce/2025/05/msg00051.html
Show 17 moreShow less
symfony.com/cve-2024-50345
nvd.nist.gov/vuln/detail/CVE-2024-50345
security-tracker.debian.org/tracker/CVE-2024-50345
ubuntu.com/security/CVE-2024-50345
cve.org/CVERecord?id=CVE-2024-50345
Left out here: 549 versions. The JSON record has them.