CVE-2024-50345

Packagist/symfony/http-foundation CVE-2024-50345: low 3.1, EPSS 0.59%

Symfony vulnerable to open redirect via browser-sanitized URLs

Action: Upgrade symfony/http-foundation to 5.4.46 or later.

composer require symfony/http-foundation:5.4.46

composer require symfony/http-foundation:6.4.14

composer require symfony/http-foundation:7.1.7

Affected

Fixed versions

Sources

• osv: GHSA-mrqx-rp3w-jpjp
• https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp
• https://nvd.nist.gov/vuln/detail/CVE-2024-50345
• https://github.com/symfony/symfony/commit/5a9b08e5740af795854b1b639b7d45b9cbfe8819
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2024-50345.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50345.yaml
• https://github.com/symfony/symfony
• https://lists.debian.org/debian-lts-announce/2025/05/msg00051.html
• https://symfony.com/cve-2024-50345
• https://url.spec.whatwg.org

CVE-2024-50345 · published 2024-11-06T15:22:09Z · modified 2025-11-03T23:05:56.908103Z · JSON