PKSA-3gxv-7xhq-mgmz: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
Published Nov 4, 2026
·Updated
Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
Affected Software
19 affected componentsFixes available
composer/symfony/http-kernel>=2.8.44, <3.0.0
3.0.0
composer/symfony/http-kernel>=3.4.14, <4.0.0
4.0.0
composer/symfony/http-kernel>=4.0.14, <5.0.0
composer/symfony/http-kernel>=5.0.0, <5.1.0
composer/symfony/http-kernel>=5.1.0, <5.2.0
composer/symfony/http-kernel>=5.2.0, <5.3.0
composer/symfony/http-kernel>=5.3.0, <5.4.0
composer/symfony/http-kernel>=5.4.0, <5.4.56
5.4.56
composer/symfony/http-kernel>=6.0.0, <6.1.0
composer/symfony/http-kernel>=6.1.0, <6.2.0
composer/symfony/http-kernel>=6.2.0, <6.3.0
composer/symfony/http-kernel>=6.3.0, <6.4.0
composer/symfony/http-kernel>=6.4.0, <6.4.50
6.4.50
composer/symfony/http-kernel>=7.0.0, <7.1.0
composer/symfony/http-kernel>=7.1.0, <7.2.0
composer/symfony/http-kernel>=7.3.0, <7.4.0
composer/symfony/http-kernel>=7.4.0, <7.4.23
7.4.23
composer/symfony/http-kernel>=8.0.0, <8.1.0
composer/symfony/http-kernel>=8.1.0, <8.1.11
8.1.11
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/http-kernelto a version that resolves this vulnerability.Fixed in 3.0.0 - Upgrade
Upgrade
composer/symfony/http-kernelto a version that resolves this vulnerability.Fixed in 4.0.0 - Upgrade
Upgrade
composer/symfony/http-kernelto a version that resolves this vulnerability.Fixed in 5.4.56 - Upgrade
Upgrade
composer/symfony/http-kernelto a version that resolves this vulnerability.Fixed in 6.4.50 - Upgrade
Upgrade
composer/symfony/http-kernelto a version that resolves this vulnerability.Fixed in 7.4.23 - Upgrade
Upgrade
composer/symfony/http-kernelto a version that resolves this vulnerability.Fixed in 8.1.11
Event History
Nov 4, 2026
Advisory Published
via Packagist·12:00 AM
Data Sourced
via Packagist·12:00 AM
DescriptionSeverityAffected Software