PKSA-68d7-b14m-3bjc: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

Published Nov 4, 2026

Updated

Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

Affected Software

19 affected componentsFixes available

composer/symfony/symfony>=2.8.44, <3.0.0

3.0.0

composer/symfony/symfony>=3.4.14, <4.0.0

4.0.0

composer/symfony/symfony>=4.0.14, <5.0.0

composer/symfony/symfony>=5.0.0, <5.1.0

composer/symfony/symfony>=5.1.0, <5.2.0

composer/symfony/symfony>=5.2.0, <5.3.0

composer/symfony/symfony>=5.3.0, <5.4.0

composer/symfony/symfony>=5.4.0, <5.4.56

5.4.56

composer/symfony/symfony>=6.0.0, <6.1.0

composer/symfony/symfony>=6.1.0, <6.2.0

composer/symfony/symfony>=6.2.0, <6.3.0

composer/symfony/symfony>=6.3.0, <6.4.0

composer/symfony/symfony>=6.4.0, <6.4.50

6.4.50

composer/symfony/symfony>=7.0.0, <7.1.0

composer/symfony/symfony>=7.1.0, <7.2.0

composer/symfony/symfony>=7.3.0, <7.4.0

composer/symfony/symfony>=7.4.0, <7.4.23

7.4.23

composer/symfony/symfony>=8.0.0, <8.1.0

composer/symfony/symfony>=8.1.0, <8.1.11

8.1.11

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 3.0.0
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 4.0.0
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 5.4.56
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 6.4.50
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 7.4.23
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 8.1.11

Nov 4, 2026

Advisory Published

via Packagist·12:00 AM

Data Sourced

via Packagist·12:00 AM

DescriptionSeverityAffected Software