{"metadata": {"vulnerability": "CVE-2026-45075", "count": 19, "kinds": {"milestone": 5, "sighting": 6, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-05-08T18:45:10.096Z", "date_only": false, "value": "2026-05-08T18:45:10.096Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-45075", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-20T10:58:29.994Z", "date_only": false, "value": "2026-05-20T10:58:29.994027Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/symfony.com/post/3mmbqq5nq7i2h", "record": "cve-2026-45075", "field": "creation_timestamp", "uuid": "2e03881d-f3da-4d36-9465-9c80ca693cd6", "content": "\ud83d\udd10 CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]\n\u27a1\ufe0f https://symfony.com/blog/cve-2026-45075-head-request-bypasses-methods-get-filter-in-isgranted-issignaturevalid-iscsrftokenvalid", "url": "https://bsky.app/profile/symfony.com/post/3mmbqq5nq7i2h"}, {"timestamp": "2026-05-20T11:59:01.677Z", "date_only": false, "value": "2026-05-20T11:59:01.677666Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mradcliffe.nokoto.org.ap.brid.gy/post/3mmbu4igtlyo2", "record": "CVE-2026-45075", "field": "creation_timestamp", "uuid": "dfa27e54-c38f-4064-b086-d132dde4f184", "content": "Symfony 7.4.12, Symfony 8.0.12 and Twig 3.26.0 releases today with a bunch of CVEs.\n\nCVE-2026-46640 in twig and CVE-2026-45075 in Symfony router and CVE-2026-45064 in Symfony sanitizer seem particularly scary.\n\n`composer update` and test, test, test.", "url": "https://bsky.app/profile/mradcliffe.nokoto.org.ap.brid.gy/post/3mmbu4igtlyo2"}, {"timestamp": "2026-05-27T21:12:38Z", "date_only": false, "value": "2026-05-27T21:12:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6439-2F28-8P8Q", "record": "GHSA-6439-2F28-8P8Q", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-02T20:42:02Z", "date_only": false, "value": "2026-07-02T20:42:02Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6439-2F28-8P8Q", "record": "GHSA-6439-2F28-8P8Q", "field": "modified", "linked_record": true}, {"timestamp": "2026-07-14T18:40:37.287Z", "date_only": false, "value": "2026-07-14T18:40:37.287Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-45075", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T18:40:37.287Z", "date_only": false, "value": "2026-07-14T18:40:37.287Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-45075", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-14T19:17:00Z", "date_only": false, "value": "2026-07-14T19:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-45075", "record": "UBUNTU-CVE-2026-45075", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-14T19:17:06.650Z", "date_only": false, "value": "2026-07-14T19:17:06.650", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-45075", "record": "FKIE_CVE-2026-45075", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-14T20:12:55.819Z", "date_only": false, "value": "2026-07-14T20:12:55.819054Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqmzel5hwk2q", "record": "CVE-2026-45075", "field": "creation_timestamp", "uuid": "d9540c67-af63-4a4c-a36a-508654cb2fec", "content": "CVE-2026-45075 - Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]\nCVE ID : CVE-2026-45075\n \n Published : July 14, 2026, 7:17 p.m. | 13\u00a0minutes ago\n \n Description : Symfony is a PHP framework for web and console ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqmzel5hwk2q"}, {"timestamp": "2026-07-16T14:38:10.546Z", "date_only": false, "value": "2026-07-16T14:38:10.546158Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-45075", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-16T14:38:10.546Z", "date_only": false, "value": "2026-07-16T14:38:10.546158Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-45075", "record": "FKIE_CVE-2026-45075", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-07-16T14:38:19.284Z", "date_only": false, "value": "2026-07-16T14:38:19.284Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-45075", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-16T14:38:19.284Z", "date_only": false, "value": "2026-07-16T14:38:19.284Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-45075", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-16T15:16:31.607Z", "date_only": false, "value": "2026-07-16T15:16:31.607", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-45075", "record": "FKIE_CVE-2026-45075", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-07-17T23:07:07.626Z", "date_only": false, "value": "2026-07-17T23:07:07.626109Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mquuisevab26", "record": "CVE-2026-45075", "field": "creation_timestamp", "uuid": "bf38c987-b990-4548-b2ee-43583b036092", "content": "\ud83d\udccc CVE-2026-45075 - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGrante... https://www.cyberhub.blog/cves/CVE-2026-45075", "url": "https://bsky.app/profile/cyberhub.blog/post/3mquuisevab26"}, {"timestamp": "2026-07-26T17:09:47.780Z", "date_only": false, "value": "2026-07-26T17:09:47.780228Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrkuq5omfd2j", "record": "CVE-2026-45075", "field": "creation_timestamp", "uuid": "e6ad1690-1b5e-48c3-8d3a-1372c13744d4", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-45075 \u0432 Symfony: \u043e\u0431\u0445\u043e\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0434\u043b\u044f HEAD-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/405094FE-C0FB-421C-8681-6BF5C1BC3035", "url": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrkuq5omfd2j"}, {"timestamp": "2026-10-17T09:42:31Z", "date_only": false, "value": "2026-10-17T09:42:31Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-45075", "record": "UBUNTU-CVE-2026-45075", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T14:22:57.333Z", "date_only": false, "value": "2026-11-06T14:22:57.333686Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117569944077003611", "record": "CVE-2026-45075", "field": "creation_timestamp", "uuid": "e1a57c91-4a6a-441d-9c3a-e9eba6d52081", "content": "CVE-2026-118514 Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\\Component\\HttpFoundation\\RequestMatcher, and RequestMatcher\\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the list verbatim, while the router serves a HEAD request with the GET handler, as HTTP semantics require.\nThis came after the incomplete fix of  CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only.\nSecurity rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects.\nThis issue also affects firewalls configured with methods: [GET]. A HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected.\nThe issue affects symfony/http-foundation through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.\nhttps://www.cve.org/CVERecord?id=CVE-2026-118514https://github.com/symfony/symfony/security/advisories/GHSA-jrf8-gvm4-7cghhttps://github.com/symfony/symfony/commit/cd20e9f8f16d1f0df6c2eac19bdb649325a192bdhttps://github.com/symfony/symfony/commit/13a8b85be687499cbc69a534ada16683f9ba3889#symfony#CVE_2026_118514#bot", "url": "https://infosec.exchange/users/cve/statuses/117569944077003611"}], "metrics": {"as_of": "2026-11-06T20:15:00.702Z", "anchors": {"origin": {"timestamp": "2026-05-27T21:12:38Z", "date_only": false, "value": "2026-05-27T21:12:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6439-2F28-8P8Q", "record": "GHSA-6439-2F28-8P8Q", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-27T21:12:38Z", "date_only": false, "value": "2026-05-27T21:12:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6439-2F28-8P8Q", "record": "GHSA-6439-2F28-8P8Q", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 14079742.702982, "hours": 3911.039639717222, "days": 162.95998498821757, "min_seconds": 14079742.702982, "max_seconds": 14079742.702982, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-27T21:12:38Z", "date_only": false, "value": "2026-05-27T21:12:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6439-2F28-8P8Q", "record": "GHSA-6439-2F28-8P8Q", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-06T20:15:00.702Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}