In Symfony before versions 4.4.7 and 5.0.7, when a Response
does not contain a Content-Type
header, affected versions of Symfony can fallback to the format defined in the Accept
header of the request, leading to a possible mismatch between the response's content and Content-Type
header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
{ "cpes": [ "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*" ], "severity": "Medium" }