PKSA-yk9m-qbjr-81kg: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

Published Nov 4, 2026

Updated

ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

Affected Software

17 affected componentsFixes available

composer/symfony/symfony>=4.3.0, <4.4.0

composer/symfony/symfony>=4.4.0, <5.0.0

composer/symfony/symfony>=5.0.0, <5.1.0

composer/symfony/symfony>=5.1.0, <5.2.0

composer/symfony/symfony>=5.2.0, <5.3.0

composer/symfony/symfony>=5.3.0, <5.4.0

composer/symfony/symfony>=5.4.0, <5.4.56

5.4.56

composer/symfony/symfony>=6.0.0, <6.1.0

composer/symfony/symfony>=6.1.0, <6.2.0

composer/symfony/symfony>=6.2.0, <6.3.0

composer/symfony/symfony>=6.4.0, <6.4.50

6.4.50

composer/symfony/symfony>=7.0.0, <7.1.0

composer/symfony/symfony>=7.1.0, <7.2.0

composer/symfony/symfony>=7.3.0, <7.4.0

composer/symfony/symfony>=7.4.0, <7.4.23

7.4.23

composer/symfony/symfony>=8.0.0, <8.1.0

composer/symfony/symfony>=8.1.0, <8.1.11

8.1.11

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 5.4.56
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 6.4.50
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 7.4.23
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 8.1.11

Nov 4, 2026

Advisory Published

via Packagist·12:00 AM

Data Sourced

via Packagist·12:00 AM

DescriptionSeverityAffected Software