CVE-2026-123339: Symfony HttpKernel improper trust of forwarded headers

CVE-2026-123339 · Severity: info · Published 2026-11-06

Symfony HttpKernel, a core component of the Symfony web framework used in PHP applications, fails to properly validate forwarded HTTP headers during inline fragment rendering. An attacker can inject malicious forwarded headers to poison cached links and modify URLs in generated emails, causing users to click on attacker-controlled sites or receive misleading information.

Vendors: Symfony.

Quick answers

Is CVE-2026-123339 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123339 being exploited in the wild.
How severe is CVE-2026-123339?
Informational severity, published 6 November 2026.
Which products and versions are affected?
Symfony HttpKernel 5.4 before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, 8.x before 8.1.11.
Is there a fix for CVE-2026-123339?
Yes: fixed in HttpKernel 5.4.56, 6.4.50, 7.4.23, 8.1.11. Until then: Configure framework.trusted_proxies to explicitly whitelist only the actual reverse proxies or TLS terminators in front of the application, and configure framework.trusted_hosts to restrict which forwarded hosts are accepted by the router. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123339 attacked?
It is attacked over the network.
Am I affected by CVE-2026-123339?
Check whether you run Symfony HttpKernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: HttpKernel 5.4.56, 6.4.50, 7.4.23, 8.1.11

Configure framework.trusted_proxies to explicitly whitelist only the actual reverse proxies or TLS terminators in front of the application, and configure framework.trusted_hosts to restrict which forwarded hosts are accepted by the router.

Technical details

RouterListener::onKernelFinishRequest() improperly trusts X-Forwarded-* and Forwarded headers when SubRequestHandler temporarily adds 127.0.0.1 to trusted proxies during inline fragment rendering in Twig or ESI tags. This causes the router context to be rebuilt with headers from any client connecting via 127.0.0.1, allowing attackers behind proxies on the same host to control the host, scheme, and port of absolute URLs generated for the rest of the request. Exploitation requires the application to be reached over HTTP from 127.0.0.1 through a proxy that forwards client headers.

Affected products

  • Symfony HttpKernel 5.4 before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, 8.x before 8.1.11

Timeline

  • 2026-11-06: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.