CVE-2026-118514

The symfony/http-foundation component (prior to versions 5.4.56 , 6.4.50 , 7.4.23 , and 8.1.11 ) contains a vulnerability where HEAD requests bypass security rules restricted to GET methods. This occurs because RequestMatcher and MethodRequestMatcher perform verbatim method comparisons, while the...

CVE-2026-118514 Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls

In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the lis...

CVE-2026-118514: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075

More info at https://symfony.com/cve-2026-118514...