GHSA-6439-2f28-8p8q
Suggest an improvement- Source
- https://github.com/advisories/GHSA-6439-2f28-8p8q
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-6439-2f28-8p8q/GHSA-6439-2f28-8p8q.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-6439-2f28-8p8q
- Aliases
-
- CVE-2026-45075
- Published
- 2026-05-27T21:12:38Z
- Modified
- 2026-05-27T21:30:09.440872204Z
- Severity
-
- 6.2 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
- Details
-
Description
Symfony's
#[IsGranted('...')],#[IsSignatureValid], and#[IsCsrfTokenValid(...)]attributes allow you to define amethods: [...]argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute definingmethods: ['GET']would be ignored for aHEADrequest.On the other hand, Symfony's router (and HTTP semantics generally) serves
HEADrequests using theGEThandler. Therefore, a controller protected by e.g.#[IsGranted('ROLE_ADMIN', methods: ['GET'])]can be reached viaHEADwith the authorization check silently skipped.Even if the
HEADrequest won't get any response content, response headers leak (Content-Length,Location, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur.Resolution
When adding
GETin themethodsoption of these attributes, Symfony now also include theHEADmethod automatically.The patch for this issue is available here for branch 7.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.
- Database specific
{ "cwe_ids": [ "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-05-27T21:12:38Z", "nvd_published_at": null, "severity": "MODERATE" }- References
-
- https://github.com/symfony/symfony/security/advisories/GHSA-6439-2f28-8p8q
- https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2026-45075.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45075.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45075.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45075
Affected packages
Packagist
symfony/http-kernel
symfony/http-kernel
symfony/security-http
Package
- Name
- symfony/security-http
- Purl
- pkg:composer/symfony%2Fsecurity-http
symfony/security-http
Package
- Name
- symfony/security-http
- Purl
- pkg:composer/symfony%2Fsecurity-http