# CVE-2026-118514: Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls

Status: published. Published: 2026-11-06. Updated: 2026-11-06.

In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the list verbatim, while the router serves a HEAD request with the GET handler, as HTTP semantics require.

This came after the incomplete fix of  CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only.



Security rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects.



This issue also affects firewalls configured with methods: [GET]. A HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected.



The issue affects symfony/http-foundation through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: Checkmarx) — https://github.com/symfony/symfony/commit/cd20e9f8f16d1f0df6c2eac19bdb649325a192bd
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: Checkmarx) — https://github.com/symfony/symfony/commit/13a8b85be687499cbc69a534ada16683f9ba3889

## Affected products and versions

- symfony / symfony (symfony/http-foundation): ≥ 0; < 5.4.56 (affected, git); ≥ 6; < 6.4.50 (affected, git); ≥ 7; < 7.4.23 (affected, git); ≥ 8; < 8.1.11 (affected, git). Source: CNA: Checkmarx

## Severity and prioritization

- CVSS 4.0: 6.3 (medium); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N; source: CNA: Checkmarx

- CVSS 4.0: 6.3 (medium); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: 596c5446-0ce5-4ba2-aa66-48b3b757a647

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-863

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-jrf8-gvm4-7cgh (CNA: Checkmarx; vendor-advisory)

- https://github.com/symfony/symfony/commit/cd20e9f8f16d1f0df6c2eac19bdb649325a192bd (CNA: Checkmarx; patch)

- https://github.com/symfony/symfony/commit/13a8b85be687499cbc69a534ada16683f9ba3889 (CNA: Checkmarx; patch)

- https://github.com/symfony/symfony/commit/13a8b85be687499cbc69a534ada16683f9ba3889 (596c5446-0ce5-4ba2-aa66-48b3b757a647)

- https://github.com/symfony/symfony/commit/cd20e9f8f16d1f0df6c2eac19bdb649325a192bd (596c5446-0ce5-4ba2-aa66-48b3b757a647)

- https://github.com/symfony/symfony/security/advisories/GHSA-jrf8-gvm4-7cgh (596c5446-0ce5-4ba2-aa66-48b3b757a647)

## Provenance

- CNA: Checkmarx: https://www.cve.org/CVERecord?id=CVE-2026-118514; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118514; retrieved 2026-11-07; source updated 2026-11-06

Revision: 1f57c1376f8e145e20a94f42529862fecedde4b618f5024298bee0ed102a3f99

Canonical: https://y2.dev/cve/CVE-2026-118514

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.