6 matches found
CVE-2026-118514
In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the lis...
EUVD-2026-118267
In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the lis...
CVE-2026-118514
The symfony/http-foundation component (prior to versions 5.4.56 , 6.4.50 , 7.4.23 , and 8.1.11 ) contains a vulnerability where HEAD requests bypass security rules restricted to GET methods. This occurs because RequestMatcher and MethodRequestMatcher perform verbatim method comparisons, while the...
CVE-2026-118514 Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls
In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the lis...
CVE-2026-118514: symfony: In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11,…
In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the lis...
Authorization Rule Misconfiguration
spring-security-config is vulnerable to Authorization Rule Misconfiguration. The vulnerability exists due to the lack of validation in the RequestMatcher of AbstractRequestMatcherRegistry.java when the application uses the requestMatchersString function with multiple servlets, one of them being...