Packagist/symfony/security-http CVE-2026-45075: high, EPSS 0.43%
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Action: Upgrade symfony/security-http to 7.4.12 or later.
composer require symfony/security-http:7.4.12composer require symfony/security-http:8.0.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.4.0 | 7.4.12 | - |
| 8.0.0 | 8.0.12 | - |
Fixed versions
| 7.4.12 | 8.0.12 |
Sources
- osv: GHSA-6439-2f28-8p8q#Packagist/symfony/security-http
- https://github.com/symfony/symfony/security/advisories/GHSA-6439-2f28-8p8q
- https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2026-45075.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45075.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45075.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45075
CVE-2026-45075 · published · modified · JSON