{"action":"Upgrade symfony to 3.4.22+dfsg-2 or later.","affected":[{"fixed":"3.4.22+dfsg-2","introduced":"0"}],"component":"symfony","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["3.4.22+dfsg-2"],"id":"tcs_01M5NDNDV4WWN8QM3D2YT8239C","modified_at":"2026-09-21T07:01:24.790981898Z","published_at":"2019-05-16T22:29:00.673Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-10913","https://security-tracker.debian.org/tracker/CVE-2019-10913"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-10913#Debian:13/symfony","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-10913"}],"summary":"In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input"}