An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through…
Priority LOW 34CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
Why it matters now
EPSS 0.01115 66th percentileScored 2026-11-07
Fix Fixed symfony/symfony (Packagist): 2.7.49, 2.8.44, 3.3.18 +3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | symfony/symfony (Packagist) | 2.7.0 to before 2.7.49 | 2.7.49 | Patch available | GHSA-66p6-7p29-55p9 |
| — | symfony/symfony (Packagist) | 2.8.0 to before 2.8.44 | 2.8.44 | Patch available | GHSA-66p6-7p29-55p9 |
| — | symfony/symfony (Packagist) | 3.3.0 to before 3.3.18 | 3.3.18 | Patch available | GHSA-66p6-7p29-55p9 |
| — | symfony/symfony (Packagist) | 3.4.0 to before 3.4.14 | 3.4.14 | Patch available | GHSA-66p6-7p29-55p9 |
| — | symfony/symfony (Packagist) | 4.0.0 to before 4.0.14 | 4.0.14 | Patch available | GHSA-66p6-7p29-55p9 |
| — | symfony/symfony (Packagist) | 4.1.0 to before 4.1.3 | 4.1.3 | Patch available | GHSA-66p6-7p29-55p9 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- symfony/symfony (Packagist) Vendor— Affected 2.7.0 to before 2.7.49 Fixed in 2.7.49 Patch available GHSA-66p6-7p29-55p9
- symfony/symfony (Packagist) Vendor— Affected 2.8.0 to before 2.8.44 Fixed in 2.8.44 Patch available GHSA-66p6-7p29-55p9
- symfony/symfony (Packagist) Vendor— Affected 3.3.0 to before 3.3.18 Fixed in 3.3.18 Patch available GHSA-66p6-7p29-55p9
- symfony/symfony (Packagist) Vendor— Affected 3.4.0 to before 3.4.14 Fixed in 3.4.14 Patch available GHSA-66p6-7p29-55p9
- symfony/symfony (Packagist) Vendor— Affected 4.0.0 to before 4.0.14 Fixed in 4.0.14 Patch available GHSA-66p6-7p29-55p9
- symfony/symfony (Packagist) Vendor— Affected 4.1.0 to before 4.1.3 Fixed in 4.1.3 Patch available GHSA-66p6-7p29-55p9
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* | 2.7.0 – 2.7.48; 2.8.0 – 2.8.43; 3.3.0 – 3.3.17; 3.4.0 – 3.4.13; 4.0.0 – 4.0.13; 4.1.0 – 4.1.2 | Vulnerable | sensiolabs |
- cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* Versions 2.7.0 – 2.7.48; 2.8.0 – 2.8.43; 3.3.0 – 3.3.17; 3.4.0 – 3.4.13; 4.0.0 – 4.0.13; 4.1.0 – 4.1.2 Vulnerable ·sensiolabs
Remediation
- Fix · GHSA-66p6-7p29-55p9 symfony/symfony (Packagist) Fixed in 2.7.49 Advisory →
- Fix · GHSA-66p6-7p29-55p9 symfony/symfony (Packagist) Fixed in 2.8.44 Advisory →
- Fix · GHSA-66p6-7p29-55p9 symfony/symfony (Packagist) Fixed in 3.3.18 Advisory →
- Fix · GHSA-66p6-7p29-55p9 symfony/symfony (Packagist) Fixed in 3.4.14 Advisory →
- Fix · GHSA-66p6-7p29-55p9 symfony/symfony (Packagist) Fixed in 4.0.14 Advisory →
- Fix · GHSA-66p6-7p29-55p9 symfony/symfony (Packagist) Fixed in 4.1.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-14774
- 2026-10-03 Alias added: GHSA-66p6-7p29-55p9
References
Patch 2
Other 6
- https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337
- https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956
- https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982
- https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba
- https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922
- https://github.com/symfony/symfony
More sensiolabs Symfony vulnerabilities
- TI-2019-13616 An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0… CVSS 3.1CRITICAL 9.8
- TI-2018-10604 An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through… CVSS 3.1MEDIUM 6.5
- TI-2019-08131 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and… CVSS 3.1CRITICAL 9.8
- TI-2016-02159 Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass… CVSS 3.0CRITICAL 9.8
- TI-2019-08459 An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. CVSS 3.1CRITICAL 9.8
- TI-2018-08136 An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-14774 · CVE Program
- CVE-2018-14774 · NVD
- FIRST EPSS
- GHSA-66p6-7p29-55p9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences