{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118514","assignerOrgId":"596c5446-0ce5-4ba2-aa66-48b3b757a647","state":"PUBLISHED","assignerShortName":"Checkmarx","dateReserved":"2026-10-28T14:33:36.992Z","datePublished":"2026-11-06T14:09:56.213Z","dateUpdated":"2026-11-06T14:09:56.213Z"},"containers":{"cna":{"providerMetadata":{"orgId":"596c5446-0ce5-4ba2-aa66-48b3b757a647","shortName":"Checkmarx","dateUpdated":"2026-11-06T14:09:56.213Z"},"title":"Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-863","description":"CWE-863","type":"CWE"}]}],"affected":[{"vendor":"symfony","product":"symfony","collectionURL":"https://packagist.org/packages/symfony/http-foundation","packageName":"symfony/http-foundation","repo":"https://github.com/symfony/http-foundation","versions":[{"status":"affected","version":"0","lessThan":"5.4.56","versionType":"git"},{"status":"affected","version":"6","lessThan":"6.4.50","versionType":"git"},{"status":"affected","version":"7","lessThan":"7.4.23","versionType":"git"},{"status":"affected","version":"8","lessThan":"8.1.11","versionType":"git"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\\Component\\HttpFoundation\\RequestMatcher, and RequestMatcher\\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the list verbatim, while the router serves a HEAD request with the GET handler, as HTTP semantics require.\n\nThis came after the incomplete fix of  CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only.\n\n\n\nSecurity rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects.\n\n\n\nThis issue also affects firewalls configured with methods: [GET]. A HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected.\n\n\n\nThe issue affects symfony/http-foundation through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.","supportingMedia":[{"type":"text/html","base64":false,"value":"<div>In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11,&nbsp;<code>Symfony\\Component\\HttpFoundation\\RequestMatcher,</code>&nbsp;and&nbsp;<code>RequestMatcher\\MethodRequestMatcher</code>&nbsp;which replaces it from 6.2.x on, matches a request against a list of HTTP methods.&nbsp;These compared the request method to the list verbatim, while the router serves a&nbsp;<code>HEAD</code>&nbsp;request with the&nbsp;<code>GET</code>&nbsp;handler, as HTTP semantics require.<br><br>This came after the incomplete fix of&nbsp;<a title=\"CVE-2026-45075\" href=\"https://github.com/advisories/GHSA-6439-2f28-8p8q\" rel=\"noreferrer\">CVE-2026-45075</a>, which&nbsp;addressed the same gap in the <code>#[IsGranted]</code>, <code>#[IsSignatureValid]</code> and <code>#[IsCsrfTokenValid]</code> attributes only.<br><br><p>Security rules configured to apply only to <code>GET</code> requests could therefore be bypassed by sending a <code>HEAD</code> request to the same URL. Although <code>HEAD</code> responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects.</p><p>This issue also affects firewalls configured with <code>methods: [GET]</code>. A&nbsp;<code>HEAD</code> request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall <code>request_matcher</code>, could also be affected.</p></div><div>The issue affects&nbsp;<code>symfony/http-foundation</code>&nbsp;through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.</div>"}]}],"references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-jrf8-gvm4-7cgh","tags":["vendor-advisory"]},{"url":"https://github.com/symfony/symfony/commit/cd20e9f8f16d1f0df6c2eac19bdb649325a192bd","tags":["patch"]},{"url":"https://github.com/symfony/symfony/commit/13a8b85be687499cbc69a534ada16683f9ba3889","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}],"credits":[{"lang":"en","value":"Ivan Tse","type":"reporter"},{"lang":"en","value":"Nicolas Grekas","type":"remediation developer"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}