Improper Trust of Forwarded Headers in Symfony HttpKernel by Symfony
CVE-2026-123339

2.3LOW

Key Information:

Vendor

Sensiolabs

Status
Symfony
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123339?

The Symfony HttpKernel vulnerability arises due to improper validation of forwarded headers in the RouterListener::onKernelFinishRequest() method. This flaw enables a remote attacker to dictate the host, scheme, and port of absolute URLs generated during the request lifecycle. If exploited, it can result in link poisoning in shared caches and potentially malicious emails being sent out with altered URLs. Affected applications accessed via HTTP from 127.0.0.1 could inadvertently trust the forwarded headers, especially when the configuration does not properly set trusted proxies. This configuration oversight allows attackers to manipulate URL generation, posing a significant risk for web applications served through reverse proxies or local caches.

Affected Version(s)

symfony 0 < 5.4.56

symfony 6.0.0 < 6.4.50

symfony 7.0.0 < 7.4.23

References

https://github.com/symfony/symfony/security/advisories/GH...
third-party-advisory
https://github.com/symfony/symfony/commit/4b4e683b2c28008...
patch

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nicolas Grekas
.