{"id":"CVE-2026-45075","aliases":["CLSA-2026-1783645391","DEBIAN-CVE-2026-45075","EUVD-2026-44350","GHSA-6439-2f28-8p8q","UBUNTU-CVE-2026-45075"],"status":"published","title":"Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00429,"percentile":0.37429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-05-27T21:12:38Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"Packagist","package":"symfony/http-kernel","fixed_in":["7.4.12","8.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"symfony/security-http","fixed_in":["7.4.12","8.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"symfony/symfony","fixed_in":["7.4.12","8.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"symfony/http-kernel","fixed_in":["v7.4.10-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"symfony","fixed_in":["7.4.12+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0"},{"fixed":"7.4.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/security-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0"},{"fixed":"7.4.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/security-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0"},{"fixed":"7.4.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"v7.4.10"},{"fixed":"v7.4.10-p1+tuxcare"}]}],"versions":["v7.4.10"]},{"source":"osv","ecosystem":"Debian:14","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.12+dfsg-1"}]}],"versions":["6.4.21+dfsg-2","6.4.24+dfsg-1","6.4.25+dfsg-1","7.0.4+dfsg-1","7.0.5+dfsg-1","7.0.6+dfsg-1","7.0.7+dfsg-1","7.1.0~beta1+dfsg-1","7.1.0~rc1+dfsg-1","7.1.2+dfsg-1","7.1.3+dfsg-1","7.1.4+dfsg-1","7.1.5+dfsg-1","7.2.0~beta1+dfsg-1","7.2.0~beta2+dfsg-1","7.2.0~rc1+dfsg-1","7.2.1+dfsg-1","7.2.2+dfsg-1","7.2.3+dfsg-1","7.2.4+dfsg-1","7.2.5+dfsg-1","7.2.6-1","7.3.0+dfsg-1","7.3.0~beta1+dfsg-1","7.3.0~beta2+dfsg-1","7.3.0~rc1+dfsg-1","7.3.1+dfsg-1","7.3.2+dfsg-1","7.3.3+dfsg-1","7.3.4+dfsg-1","7.3.5-1","7.4.0+dfsg-1","7.4.0+dfsg-2","7.4.0~beta1-1","7.4.0~beta1-2","7.4.0~beta2+dfsg-1","7.4.0~beta2+dfsg-2","7.4.0~beta2+dfsg-3","7.4.0~rc1+dfsg-1","7.4.0~rc2+dfsg-1","7.4.0~rc3+dfsg-1","7.4.10+dfsg-1","7.4.2+dfsg-1","7.4.2+dfsg-2","7.4.3+dfsg-1","7.4.4+dfsg-1","7.4.5+dfsg-1","7.4.6+dfsg-1","7.4.6+dfsg-2","7.4.7+dfsg-1","7.4.8+dfsg-1","7.4.9+dfsg-1"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0"},{"fixed":"7.4.12"}]}],"versions":["v7.4.0","v7.4.1","v7.4.10","v7.4.11","v7.4.2","v7.4.3","v7.4.4","v7.4.5","v7.4.6","v7.4.7","v7.4.8"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}],"versions":["v8.0.0","v8.0.1","v8.0.10","v8.0.11","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.0.8"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/security-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0"},{"fixed":"7.4.12"}]}],"versions":["v7.4.0","v7.4.1","v7.4.11","v7.4.3","v7.4.4","v7.4.6","v7.4.8","v7.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/security-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}],"versions":["v8.0.0","v8.0.1","v8.0.11","v8.0.3","v8.0.4","v8.0.6","v8.0.8","v8.0.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0"},{"fixed":"7.4.12"}]}],"versions":["v7.4.0","v7.4.1","v7.4.10","v7.4.11","v7.4.2","v7.4.3","v7.4.4","v7.4.5","v7.4.6","v7.4.7","v7.4.8","v7.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}],"versions":["v8.0.0","v8.0.1","v8.0.10","v8.0.11","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.0.8","v8.0.9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1+dfsg-1","2.7.5+dfsg-1","2.7.9+dfsg-1","2.7.9+dfsg-1ubuntu2","2.7.10-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.7+dfsg-1.3ubuntu1","3.4.3+dfsg-1ubuntu4","3.4.6+dfsg-1","3.4.6+dfsg-1ubuntu0.1","3.4.6+dfsg-1ubuntu0.1+esm1","3.4.6+dfsg-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4+dfsg-1ubuntu1","4.3.8+dfsg-1ubuntu1","4.3.8+dfsg-1ubuntu1+esm1","4.3.8+dfsg-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.6+dfsg-1ubuntu7","5.4.4+dfsg-1ubuntu8","5.4.4+dfsg-1ubuntu8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.23+dfsg-1ubuntu1","5.4.35+dfsg-3ubuntu1","6.4.5+dfsg-3ubuntu2","6.4.5+dfsg-3ubuntu3","6.4.5+dfsg-3ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.18+dfsg-1ubuntu1","6.4.21+dfsg-2","6.4.21+dfsg-2ubuntu1","6.4.24+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.7+dfsg-1ubuntu1","7.4.9+dfsg-1ubuntu1","7.4.13+dfsg-2ubuntu1","7.4.14+dfsg-1ubuntu2","7.4.15+dfsg-2ubuntu2","7.4.16+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.24+dfsg-1","7.4.5+dfsg-1ubuntu1","7.4.6+dfsg-2ubuntu1","7.4.7+dfsg-1ubuntu1"]}],"products":[{"vendor":"sensiolabs","product":"symfony"},{"vendor":"symfony","product":"http-kernel"},{"vendor":"symfony","product":"security-http"},{"vendor":"symfony","product":"symfony"}],"references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-6439-2f28-8p8q","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/symfony/symfony/releases/tag/v7.4.12","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/symfony/symfony/releases/tag/v8.0.12","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2026-45075.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45075.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45075.yaml","tags":["web"]},{"url":"https://symfony.com/cve-2026-45075","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6439-2f28-8p8q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45075.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45075","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45075","tags":["advisory"]},{"url":"https://github.com/symfony/symfony","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-45075","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45075","tags":["report"]},{"url":"https://symfony.com/blog/cve-2026-45075-head-request-bypasses-methods-get-filter-in-isgranted-issignaturevalid-iscsrftokenvalid","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-45075","title":"Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.","status":"published","published":"2026-07-14T18:40:37.287Z","modified":"2026-07-16T14:38:19.284Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-44350","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.","status":"published","published":"2026-07-14T18:40:37Z","modified":"2026-07-16T14:38:19Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:51.881225Z"}],"ghsa":[{"id":"GHSA-6439-2f28-8p8q","title":"Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]","description":"### Description\n\nSymfony's `#[IsGranted('...')]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` attributes allow you to define a `methods: [...]` argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining `methods: ['GET']` would be ignored for a `HEAD` request.\n\nOn the other hand, Symfony's router (and HTTP semantics generally) serves `HEAD` requests using the `GET` handler. Therefore, a controller protected by e.g. `#[IsGranted('ROLE_ADMIN', methods: ['GET'])]` can be reached via `HEAD` with the authorization check silently skipped.\n\nEven if the `HEAD` request won't get any response content, response headers leak (`Content-Length`, `Location`, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur.\n\n### Resolution\n\nWhen adding `GET` in the `methods` option of these attributes, Symfony now also include the `HEAD` method automatically.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838) for branch 7.4.\n\n### Credits\n\nSymfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.","status":"published","published":"2026-05-27T21:12:38Z","modified":"2026-07-02T20:42:03Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:40:38.48196Z"}],"nvd":[{"id":"CVE-2026-45075","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.","status":"published","published":"2026-07-14T19:17:06.65Z","modified":"2026-07-16T15:16:31.607Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-45075","title":"Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.","status":"published","published":"2026-07-14T18:40:37.287Z","modified":"2026-10-28T02:30:21.799180809Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-45075","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.","status":"published","published":"2026-07-14T19:17:06.65Z","modified":"2026-10-01T03:03:14.63667064Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-6439-2f28-8p8q","title":"Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]","description":"### Description\n\nSymfony's `#[IsGranted('...')]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` attributes allow you to define a `methods: [...]` argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining `methods: ['GET']` would be ignored for a `HEAD` request.\n\nOn the other hand, Symfony's router (and HTTP semantics generally) serves `HEAD` requests using the `GET` handler. Therefore, a controller protected by e.g. `#[IsGranted('ROLE_ADMIN', methods: ['GET'])]` can be reached via `HEAD` with the authorization check silently skipped.\n\nEven if the `HEAD` request won't get any response content, response headers leak (`Content-Length`, `Location`, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur.\n\n### Resolution\n\nWhen adding `GET` in the `methods` option of these attributes, Symfony now also include the `HEAD` method automatically.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838) for branch 7.4.\n\n### Credits\n\nSymfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.","status":"published","published":"2026-05-27T21:12:38Z","modified":"2026-09-10T03:51:04.868176127Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2026-45075","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.","status":"published","published":"2026-07-14T19:17:00Z","modified":"2026-10-17T13:00:11.321193395Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"CLSA-2026-1783645391","title":"TuxCare security update for symfony/http-kernel (1 CVE)","description":"TuxCare rebuilt symfony/http-kernel to address 1 CVE. Fixed in v7.4.10-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:53.488163387Z","updated_at":"2026-11-02T15:43:46.151924Z"}]}}