CVE-2026-123339

The Symfony HttpKernel component is vulnerable to an improper trust of forwarded headers in RouterListener::onKernelFinishRequest() across several versions: prior to 5.4.56 , 6.x prior to 6.4.50 , 7.x prior to 7.4.23 , and 8.x prior to 8.1.11 . When a page renders an inline fragment, the system t...