CLEANSTART-2026-HD10581: In Symfony http-foundation prior to versions 5

Q: Who can exploit this issue?

The vector indicates network-reachable exploitation with no privileges or user interaction required. The attack requirements metric is present, meaning exploitation depends on at least one condition beyond the attacker's direct control.

Q: What impact is indicated if exploitation succeeds?

The severity is rated medium with a score of 6.3. The listed impacts are low confidentiality and low integrity impact, with no availability impact.

Published Nov 14, 2026

Updated

Security vulnerability affects the drupal package. In Symfony http-foundation prior to versions 5.

Affected Software

3 affected componentsFixes available

cleanstart/drupal<11.4.11-r0

11.4.11-r0

cleanstart/drupal<11.1.10-r0

11.1.10-r0

cleanstart/drupal<11.2.14-r0

11.2.14-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/drupal to a version that resolves this vulnerability.
Fixed in 11.4.11-r0
Upgrade
Upgrade cleanstart/drupal to a version that resolves this vulnerability.
Fixed in 11.1.10-r0
Upgrade
Upgrade cleanstart/drupal to a version that resolves this vulnerability.
Fixed in 11.2.14-r0
Upgrade
Upgrade symfony/http-foundation to a version that resolves this vulnerability.
Fixed in 5

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118514

Frequently Asked Questions

Who can exploit this issue?

The vector indicates network-reachable exploitation with no privileges or user interaction required. The attack requirements metric is present, meaning exploitation depends on at least one condition beyond the attacker's direct control.

What impact is indicated if exploitation succeeds?