CVE-2026-123339 Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

[
  {
    "vendor": "sensiolabs",
    "product": "symfony",
    "collectionURL": "https://packagist.org/packages/symfony/http-kernel",
    "packageName": "symfony/http-kernel",
    "repo": "https://github.com/symfony/http-kernel",
    "modules": [
      "Symfony\\Component\\HttpKernel\\EventListener\\RouterListener::onKernelFinishRequest"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "5.4.56",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6.0.0",
        "lessThan": "6.4.50",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.4.23",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8.0.0",
        "lessThan": "8.1.11",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected"
  }
]