CVE-2024-50345: Open redirect via browser-sanitized URLs in symfony/http-foundation

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-06 · updated 2026-06-17
Weakness: CWE-601

Description

symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

symfony: before 5.4.46; from 6.0.0 before 6.4.14; from 7.0.0 before 7.1.7 — fixed in 5.4.46, 6.4.14, 7.1.7
Packagist Symfony/Http-Foundation: before 5.4.46; from 6.0.0 before 6.4.14; from 7.0.0 before 7.1.7; 2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.12 (+584) — fixed in 5.4.46, 6.4.14, 7.1.7

How to fix

Upgrade to a fixed version: symfony 5.4.46, 6.4.14, 7.1.7; Packagist Symfony/Http-Foundation 5.4.46, 6.4.14, 7.1.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-50345 or the next vulnerability affects your stack