Review reviewHigh

CVE-2026-45075

symfony symfony, http-kernel, security-http

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.

CVSS: 8.3
EPSS: 0.38%
CISA KEV: Not listed
Published: 2026.07.15

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.38%

Technical severityCVSS 8.3

Vulnerability overview

Affected product and versions

Product: symfony symfony, http-kernel, security-http
Affected versions: >= >= 7.4.0-BETA1, < 7.4.12, >= >= 8.0.0-BETA1, < 8.0.12, >= 7.4.0 < 7.4.12, >= 8.0.0 < 8.0.12
Fixed versions: 7.4.12, 8.0.12

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that symfony symfony, http-kernel, security-http and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE: CWE-863