CVE-2021-41267

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP
framework for web and console applications and a set of reusable PHP
components. Headers that are not part of the “trusted_headers” allowed list
are ignored and protect users from “Cache poisoning” attacks. In Symfony
5.2, maintainers added support for the X-Forwarded-Prefix headers, but
this header was accessible in SubRequest, even if it was not part of the
“trusted_headers” allowed list. An attacker could leverage this opportunity
to forge requests containing a X-Forwarded-Prefix header, leading to a
web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure
that the X-Forwarded-Prefix header is not forwarded to subrequests when
it is not trusted.