Vulnerabilities

Vulnerability · CVE-2026-118514

Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls

Published Nov 6, 2026 · catalog updated Nov 7, 2026 · Symfony: HEAD Requests Bypass

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-118514. EPSS is 0.61%. Act only if a listed version of Symfony: HEAD Requests Bypass is installed.

Severity

Medium6.3

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.61%

Remediation

Advisory link

Affected products

Debian:12 symfony · Debian:13 symfony · Debian:14 symfony · vendor symfony symfony

In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the list verbatim, while the router serves a HEAD request with the GET handler, as HTTP semantics require. This came after the incomplete fix of CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only. Security rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects. This issue also affects firewalls configured with methods: [GET]. A HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected. The issue affects symfony/http-foundation through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.