symfony/security-http vulnerabilities

CVEs whose affected-version data names the symfony/security-http package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-48489High

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

▾ Twilightsymfony · symfony/security-httpEPSS 0.60%via GHSA

symfony/security-http vulnerabilities (CVEs) · VulnSea