CVE-2026-123339

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of...

EUVD-2026-118273

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of...

CVE-2026-123339

The Symfony HttpKernel component is vulnerable to an improper trust of forwarded headers in RouterListener::onKernelFinishRequest() across several versions: prior to 5.4.56 , 6.x prior to 6.4.50 , 7.x prior to 7.4.23 , and 8.x prior to 8.1.11 . When a page renders an inline fragment, the system t...

CVE-2026-123339 Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of...

CVE-2026-123339: sensiolabs symfony: Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to…

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of...