HTTP Method Vulnerability in Symfony HTTP Foundation Affects Versions Below 5.4.56

CVE-2026-118514

What is CVE-2026-118514?

The vulnerability found in Symfony's HTTP Foundation prior to specific versions allows attackers to bypass security measures configured for GET requests by leveraging HEAD requests. While HEAD requests do not return a body, they still expose response headers and can trigger controller execution. This issue is particularly concerning for applications and firewalls that rely on strict method matching, as a HEAD request may evade detection and security measures. The incomplete mitigation in prior CVE cases highlights the need for awareness and timely updates to protect against potential exploits.

References